DKIM Setup Guide: How to Sign Your Emails Cryptographically

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. This signature proves that the email genuinely came from your domain and hasn't been modified in transit — making your emails more trustworthy and less likely to land in spam.

What Is DKIM?

When you send an email, your mail server adds a hidden DKIM signature to the message headers. The recipient's server then checks your domain's DNS for the matching public key to verify the signature. If it matches, the email is authentic.

Think of it like a wax seal on an envelope — it proves who sent the letter and that nobody opened it along the way.

How to Set Up DKIM

The exact steps depend on your email provider. Most providers generate the DKIM key for you — you just need to add the DNS record they give you.

Google Workspace DKIM Setup

1. Sign in to admin.google.com.
2. Go to Apps → Google Workspace → Gmail → Authenticate email.
3. Select your domain and click Generate new record.
4. Copy the TXT record name and value shown.
5. Add this as a TXT record in your domain's DNS (with the host/name Google specifies).
6. Return to Google Admin and click Start authentication.

Microsoft 365 DKIM Setup

1. Go to the Microsoft 365 Defender portal → Email & collaboration → Policies & rules → Threat policies → DKIM.
2. Select your domain and click Enable.
3. Microsoft will show you two CNAME records to add to your DNS.
4. Add both CNAME records to your DNS provider.
5. Once DNS propagates, Microsoft will activate DKIM automatically.

cPanel Hosting DKIM Setup

1. Log in to cPanel.
2. Go to Email → Email Deliverability.
3. Click Manage next to your domain.
4. cPanel will show you the DKIM TXT record to add to your DNS. Copy and paste it.
5. If your DNS is managed by cPanel, click Install the suggested record — done!

What a DKIM DNS Record Looks Like

Host:   default._domainkey.yourdomain.com
Type:   TXT
Value:  v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...

How to Verify DKIM Is Working

• Send a test email to a Gmail address. Open the email → click the three-dot menu → Show original. Look for dkim=pass.
• Use MXToolbox DKIM Checker (mxtoolbox.com/dkim.aspx) — enter your domain and selector.