Guide Email

How to set up DKIM signing

How to enable DKIM signing for your domain and publish the selector record that lets receiving servers verify it.

iFastHosting Support Team Updated 26 August 2026 7 min read Intermediate

DKIM adds a digital signature to every message your domain sends, generated with a private key your mail server holds. Receiving servers fetch the matching public key from your DNS and use it to check two things at once: that the message really came from your domain, and that nothing in the signed parts of it was changed in transit. Unlike SPF, which checks where a message came from, DKIM checks whether it arrived intact.

Setting it up is mostly a case of turning it on and copying one record — the cryptography is handled entirely by your mail provider.

Step 1: enable DKIM in your control panel

Find the email authentication settings
Open the section of your control panel dealing with domain email settings, where SPF and DMARC options are usually grouped alongside DKIM.
Turn on DKIM for the domain
Selecting this generates a matching private and public key pair automatically. You do not create or choose these yourself.
Copy the record it displays
Your control panel shows a selector — a short name such as selector1 — and a long value starting v=DKIM1; k=rsa; p=….

Step 2: publish the DNS record

Some control panels publish this record automatically once DKIM is turned on, since the DNS and the mailboxes are managed in the same place. If yours requires a manual step, add it as a TXT record with:

Field	Value
Host / name	`selector1._domainkey` (the selector shown, exactly as given)
Type	TXT
Value	The full `v=DKIM1; k=rsa; p=…` string

Copy the p= value exactly, all in one piece

The public key is long, and it is the single most common place this setup goes wrong. Do not introduce line breaks, drop the surrounding quotation marks if your control panel expects them, or leave out any part of the string when it wraps across multiple lines on screen. A truncated key fails validation with an error that gives no hint the key itself was the problem.

Step 3: confirm it is working

Send a test message to an account where you can view the full message headers — most webmail interfaces and desktop mail clients have a "view source" or "show original" option. Look for an Authentication-Results header, which will show dkim=pass once the signature verifies correctly.

Authentication-Results: mx.example.com;
  dkim=pass header.i=@yourdomain.com header.s=selector1

You can also query the DKIM record directly to confirm it published correctly:

dig TXT selector1._domainkey.yourdomain.com +short

Multiple selectors

A domain can run more than one DKIM selector at the same time, each with its own key. This matters most when changing mail providers: publish the new provider's selector alongside the old one, switch sending over, confirm the new signature is verifying correctly, and only then remove the old selector's record. Trying to swap both in a single step risks a gap where outgoing mail is unsigned.

DKIM alone does not stop spoofing

A signed message proves the domain named in the signature sent it — but nothing forces that domain to match the address the recipient actually sees in their inbox. That link is what DMARC checks, which is why DKIM and SPF are usually set up together with DMARC rather than DKIM alone. See setting up a DMARC record.

If DKIM will not verify

Recheck the selector name matches exactly between what your mail server is signing with and what you published in DNS — a mismatch here means the receiving server looks up the wrong record entirely.
Confirm the record published without truncation, particularly if your DNS panel has a character limit per TXT record that split a long key incorrectly.
Allow time for DNS to spread before troubleshooting further — see how long DNS propagation takes.
Check the record with a DKIM validation tool, several of which are available free online and will point out a malformed value directly.

With SPF and DKIM both in place, the last piece is a DMARC record, which ties the two together and tells receiving servers what to do when a message fails either check.

Does DKIM sign every message automatically?

Once enabled for a mailbox or domain, DKIM signing happens automatically on the mail server for every message that mailbox sends — there is nothing to switch on per message, and no visible change in how you compose or send mail. The signature is added invisibly as the message leaves your mail server, which is why setup is a one-time task rather than an ongoing habit.

What happens to mail sent before DKIM was enabled

DKIM has no retroactive effect — messages already sent and delivered before the record was published were never signed and cannot be signed after the fact. This is not a problem in practice, since authentication is checked at the moment a message is received, not looked up again later. Going forward, everything sent from the point DKIM is enabled onward carries a valid signature.

DKIM and forwarded mail

A DKIM signature can sometimes fail to verify after a message passes through a forwarder, since forwarding occasionally modifies parts of the message that the signature covers — an added subject line prefix, or a footer inserted by the forwarding service, for instance. This is a known limitation of DKIM generally rather than something specific to any one setup, and is one of the reasons DMARC allows some flexibility in how strictly alignment is checked. If forwarded mail is failing DKIM specifically, it is rarely something to fix on your own domain's side.

DKIM is invisible to the person you send mail to

Recipients never see any indication that a message was signed — there is no visible marker in their inbox. Its effect only shows up in whether mail is trusted and delivered normally, which is precisely why it is easy to forget it is even running once it has been set up correctly.

If you would like the fuller picture of how SPF, DKIM and DMARC work together rather than as three separate tasks, SPF, DKIM and DMARC explained covers the relationship between all three from the start.

Frequently asked questions

Do I create the DKIM key myself?

No. Your mail provider generates the public and private key pair for you when you turn on DKIM signing. You only publish the public half as a DNS record — the private key stays on the mail server and is never something you handle directly.

What is a DKIM selector?

The selector is a short label at the front of the DKIM record's hostname, such as selector1._domainkey.yourdomain.com. It lets a domain run more than one DKIM key at once — useful when switching mail providers, since the old and new keys can both be published under different selectors during the changeover.

Why does DKIM fail after I paste the record?

Almost always because the long p= value was cut, had a line break inserted, or picked up extra spaces during copying. Some DNS panels also wrap long TXT values automatically in a way that breaks a pasted key — check your control panel's guidance on long TXT records if the value is close to or over 255 characters.