What is DKIM?
DKIM cryptographically signs outgoing messages so a receiver can verify the domain and that the content was not altered in transit. The public key is published in DNS. Together with SPF it forms the basis on which DMARC makes a pass or fail decision.
Why DKIM matters
The public key is published in DNS. Together with SPF it forms the basis on which DMARC makes a pass or fail decision.
DKIM in practice
When you run a mail server, DKIM is a DNS TXT record with your public key and a selector in your mail software. You look at the Authentication-Results header in a test message you send yourself. You change the selector if you rotate keys. If you get it wrong—wrong key, wrong selector, record not propagated—receivers silently treat your mail as unsigned, and DMARC may start failing you. Your deliverability drops without a clear error in your own logs. Verifying it before you rely on it saves you that.
What people get wrong about DKIM
People assume DKIM guarantees the sender is legitimate. It doesn't. It only proves the message came from the domain that signed it. A spammer with your domain's key (stolen, misconfigured, or exposed via an open signer) signs it fine. The correction: DKIM is about integrity and alignment, not sender trust. Pair it with SPF and DMARC.
DKIM — common questions
What is a DKIM selector?
A selector is the name that ties your DKIM signature to a specific public key in DNS. For example, 'google' in google._domainkey.example.com. It lets you rotate keys without breaking mail already in transit. Keep it in sync with your mail software.
How do I test if DKIM is working?
Send a message to a Gmail or Outlook address and inspect the headers. Look for the Authentication-Results line. If it says 'dkim=pass' with your domain, it works. If it says 'fail' or 'neutral', check your DNS record and key selector.
Where DKIM comes up
- Can I run my own mail server on a VPS? Yes. Port 25 is open, reverse DNS is self-service, and our address space has no spam history. Mailcow or Stalwart give you a complete stack in an evening. …
- A self-hosted mail server that actually reaches the inbox Installing a mail server is easy; being trusted by receivers is not. You need outbound port 25, a PTR record matching your banner hostname, SPF, DKIM and D…
- Is outbound port 25 open, so I can run a mail server? Yes, outbound port 25 is open on every OnionVPS instance by default. There is no support ticket, no account-age requirement and no paid unblock. Most provi…