What is DKIM? A tamper-evident signature for email

1. Your email provider creates a private/public key pair. The private key stays on its sending system.
2. You publish the public key as a TXT or provider-directed CNAME record in DNS.
3. For each outgoing message, the provider hashes the body and selected headers, signs the result, and adds a DKIM-Signature header.
4. The receiver reads the signing domain (d=) and selector (s=), then requests the public key at selector._domainkey.domain.
5. If the cryptographic verification succeeds, DKIM passes.

Header: DKIM-Signature: ... d=example.com; s=mail2026; ...
DNS:    mail2026._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIB..."

A selector is simply a key name. It lets a domain publish multiple keys at once: one for Google Workspace, one for a marketing platform, and a new one during rotation. Selectors are not secret; they appear in every signed message.

Some providers give you a CNAME instead of a TXT value. That is normal: the CNAME delegates key hosting and rotation to the provider. Publish exactly the record type and host it supplies.

A cryptographically valid signature can still fail DMARC if it signs with an unrelated domain. For DKIM to contribute a DMARC pass, the d= domain must align with the visible From domain. Under relaxed alignment, a subdomain relationship is enough; strict alignment requires an exact match.

• The public key is missing, malformed, published under the wrong selector, or not fully propagated.
• The sending platform has a key configured but DKIM signing was never enabled.
• The provider rotated its private key while DNS still contains the old public key.
• A forwarding gateway, footer tool, or mailing list changed signed headers or the body.
• The message uses an expired signature or an unsupported/weak key configuration.

A body hash did not verify result points specifically to message-body changes. Use the header analyzer to see the receiver's result and the DKIM checker to test the public key.

Generate or request a key in each sending platform, publish its DNS record, wait for the provider to detect it, and explicitly turn on signing. Then send a real message and confirm that dkim=pass uses a d= domain aligned with your From address. The full workflow is in how to enable DKIM.

Use 2048-bit RSA keys when your provider and DNS host support them, or the provider's supported modern alternative. Rotate keys periodically and immediately after suspected private-key exposure. Rotation is safer when you publish a new selector before retiring the old one, allowing in-flight mail to verify.