How to Set Up DKIM: Step-by-step DKIM Configuration Guide
by
Reading Time: 6 min
DKIM or DomainKeys Identified Mail is an email authentication protocol that verifies the authenticity of outbound emails. DKIM setup involves using a private cryptographic key generated by your mail server which signs each outgoing email message. Setting up DKIM for your domain ensures your recipients can verify that the emails they receive were sent from your mail server and are not forged.
To place it simply, DKIM adds a digital signature to your emails confirming they were sent from your domain. Proper DKIM configuration is essential for improving email security, enhancing deliverability, and preventing spoofing attacks.
In this blog, you will learn how to set up DKIM for your own domain easily!
How to Setup DKIM to Protect Your Domain from Spoofing?
Key Takeaways
Step-by-Step Guide to DKIM Setup
Here are three simple steps to set up DKIM for your domain/ domains:
1. Access Your DNS
To get started you need access to your Domain Name System. You can contact your DNS provider or host to help you in this process.
2. Create and Add Your DKIM Record
Create Your DKIM record using our DKIM record generator tool. Once you generate your DKIM key pair, publish the DKIM public key in your DNS settings and save changes. Use the private key to sign your outgoing messages.
3. Verify Your DKIM Setup
Once you have configured your DKIM record, verify it using our DKIM checker tool. This tool will tell you if your record is valid, error-free, and set up correctly!
Want to automate your DKIM setup and management process? Get started with Hosted DKIM for free!
Understanding DKIM Signatures and Selectors
Not to be confused with a DKIM selector, a DKIM signature is nothing more than a collection of randomized string values also known as “hash values”. When your domain is configured with DKIM, your sending email server encrypts this value with a private key that only you have access to.
What is a DKIM Signature?
A DKIM signature is a cryptographic hash added to an email’s header. To use DKIM, you need to decide what should be included in the signature. Typically this is the body of the email and some default headers. You can’t change these elements once they’re set, so choose them carefully. Once you have decided what parts of the email will be included in the DKIM signature, these elements must remain unchanged to maintain a valid DKIM signature.
This signature ensures that the email you send has not been altered or tampered with after it was sent. To validate the DKIM signature, the email receiver will run a DNS query to search for the public key. The public key will have been provided by the organization that owns the domain. If they match, your email is classified as authentic.
How to Identify Your DKIM Selector
A common question often raised by domain owners is how do I find my DKIM? In order to find your DKIM selector, all you need to do is:
1) Send a test mail to your Gmail account
2) Click on the 3 dots next to the email in your Gmail inbox
3) Select “show original”
4) On the “Original Message” page navigate to the bottom of the page to the DKIM signature section and try to locate the “s=” tag, the value of this tag is your DKIM selector.
DKIM Configuration for Popular Email Services
If you are using different email services to send your business or commercial emails – you need to set up DKIM for them. This will ensure your email vendor is sending compliant emails to your receivers, increasing your email deliverability.
DKIM Setup for Google Workspace
- Check if you have DKIM already set up for your domain using our DKIM validator tool.
- If you are not using Google Workspace, you can use PowerDMARC’s DKIM generator tool to create your record.
- If you are using Google Workspace, sign in to Google Admin Console
- Go to Menu > Apps > Google Workspace> Gmail.
- Click on Authenticate Email
- Select your domain from the list and click on the Generate New Record button to get started with record creation.
- Once generated, publish the public key in your DNS settings and save changes.
DKIM Setup for Microsoft Office 365
- Go to Email authentication settings in the Defender portal:
https://security.microsoft.com/authentication. - On the DKIM tab, select the custom domain to configure (click anywhere on the row except the checkbox).
- In the domain details flyout, toggle Sign messages for this domain with DKIM signatures to Disabled.
- Note the Last checked date value.
- Copy the CNAME record values from the error dialog.
- Open your domain registrar’s website and create two CNAME records using the copied values:
- Hostname: selector1._domainkey → Value: selector1-contoso-com._domainkey.contoso.onmicrosoft.com.
- Hostname: selector2._domainkey → Value: selector2-contoso-com._domainkey.contoso.onmicrosoft.com.
- Wait a few minutes (or longer) for DNS propagation.
- Return to the flyout and toggle Sign messages for this domain with DKIM signatures to Enabled.
- Verify:
- Toggle is set to Enabled.
- Status is Signing DKIM signatures for this domain.
- Last checked date is updated.
FAQs About DKIM Setup
How can I verify my DKIM setup?
To verify your DKIM setup, you can manually check your DKIM headers by clicking on your email properties. To automate the verification process, use our DKIM lookup tool.
What happens if DKIM verification fails?
In case your DKIM verification fails, depending on your alignment enforcement policy your email may either be rejected or marked as spam. The next step should be
How do I handle DKIM for third-party email providers?
If you are using multiple third-party email providers, handling DKIM manually can get tough. Using a hosted email authentication service is your best bet in that case for easy DKIM signature and key management.
What’s the difference between a DKIM signature and a public key?
The DKIM signature is a cryptographic hash added to an email’s header to verify that its content hasn’t been altered during transit and to authenticate the sender. It is generated by the sender’s mail server using a private key and is unique to each email.
In contrast, the public key is a static cryptographic key published in the sender’s DNS records, allowing receiving mail servers to validate the DKIM signature.
While the signature is included in the email headers, the public key is publicly accessible via DNS and serves as the mechanism to confirm the signature’s authenticity.
How does DKIM protect against email spoofing?
The DKIM signature is generated by the MTA and is stored in the list domain. After receiving the email, you can verify the DKIM by using the public key. DKIM as an authentication mechanism that can prove the identity of a message. This signature proves that the message is generated by a legitimate server.
This is especially required since domain spoofing attacks have been on the rise in recent times.
Domain & Email Security Expert at PowerDMARC
Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.
Latest posts by Ahona Rudra (see all)
- PowerDMARC in 2024: A Year in Review - December 24, 2024
- Travel Cybersecurity Threats and How to Stay Protected - December 18, 2024
- Cybersecurity Best Practices for Digital Nomads in Japan - December 17, 2024
