How to: Verify and configure DKIM signing

How to: Verify and configure DKIM signing

When to use this guide

Use this guide when  easydmarc.com/tools/dkim-lookup  (listed in the  Domain & server security checklist⁠ ) shows any of:
  • No DKIM record found for the domain
  • DKIM key length is less than 2048 bits
  • DKIM signing is not enabled for outgoing mail
How urgent is this? DKIM is high priority. Without DKIM, receiving mail servers cannot verify that emails from your domain are legitimate. This makes it significantly easier for attackers to spoof your domain, and reduces email deliverability. DKIM is also a prerequisite for effective DMARC enforcement.

Who does this?

The person holding the  Domains & DNS role  in your organisation, together with whoever manages the organisation's email platform (e.g. Google Workspace admin).
This requires access to two places:
    The email platform (e.g. Google Workspace, Microsoft 365) — to generate or locate the DKIM key
    The DNS hosting provider — to publish the DKIM TXT record


Background: what does DKIM do?

Concept
What it does
DKIM signing
Adds a cryptographic signature to every outgoing email, so receiving servers can verify it hasn't been tampered with
DKIM key
A public/private key pair — the private key signs outgoing mail, the public key is published in DNS
Key length
2048-bit keys are the current minimum standard; 1024-bit keys are considered weak and should be rotated
Selector
A label in the DNS record (e.g. google._domainkey) that allows multiple DKIM keys for the same domain


Step 1: Check whether DKIM is enabled

Look up existing DKIM records using  easydmarc.com/tools/dkim-lookup . Enter the domain and try common selectors:
  • google (Google Workspace)
  • selector1 , selector2 (Microsoft 365)
  • k1 , k2 , k3 (Mailchimp / Mandrill)
  • default
If a valid record is found, check the key length — it should be at least 2048 bits. If the key is 1024-bit, proceed to Step 3 to rotate it.
If no record is found, proceed to Step 2.


Step 2: Enable DKIM signing in your email platform

Google Workspace:
Go to Admin Console → Apps → Google Workspace → Gmail → Authenticate email. Select the domain, generate a new DKIM key (choose 2048-bit), and copy the DNS record value shown.
Microsoft 365:
Go to the Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → DKIM. Select the domain and enable DKIM signing. Copy the CNAME records shown.
Other platforms:
Consult the platform's documentation for "enable DKIM". Most email platforms provide a DNS record to publish after enabling signing.


Step 3: Publish the DKIM record in DNS

In the DNS settings for the domain, add a TXT record with the values provided by your email platform:
  • Name: [selector]._domainkey.[yourdomain] (e.g. google._domainkey.doneereffectief.nl )
  • Value: the key provided by the email platform (starts with v=DKIM1; k=rsa; p=... )
DNS changes can take up to 48 hours to propagate.


Step 4: Rotate a weak 1024-bit key

If an existing DKIM key is 1024-bit, rotate it to 2048-bit:
    Generate a new 2048-bit key in your email platform (use a new selector name to avoid disruption)
    Publish the new key in DNS
    Wait for DNS propagation (verify with  easydmarc.com/tools/dkim-lookup  )
    Enable signing with the new key in the email platform
    Remove the old 1024-bit DNS record
Do not remove the old key before the new one is verified and active — this will cause email delivery failures.


Step 5: Verification

  • Check Mark Button A valid DKIM record exists for all active selectors
  • Check Mark Button Key length is 2048 bits or higher
  • Check Mark Button Send a test email and check the headers — look for DKIM=pass in the Authentication-Results header