DKIM (DomainKeys Identified Mail)

What DKIM email signing does, how it proves your mail wasn't forged or altered, and how to enable it on Google Workspace, Microsoft 365, and other providers.

What it is

DKIM adds a cryptographic signature to outgoing email. Receivers verify it against your public key in DNS, proving the message wasn't altered and really came from your domain.

Why it matters

DKIM survives forwarding better than SPF and is required for DMARC alignment. Without it, your legitimate mail is more likely to be flagged.

How to fix it

Google Workspace

Admin → Apps → Gmail → Authenticate email → Generate DKIM key → add TXT record

Microsoft 365

Defender portal → Email & collaboration → Policies → DKIM → enable per domain

Verify

Send to a Gmail account → Show original → check dkim=pass

See if your site passes

Check your DKIM record free

FAQ

How do I find my DKIM selector?

Google uses 'google', Microsoft uses 'selector1'/'selector2'. Check your provider's docs — our email checker probes common selectors automatically.

More explainers: HSTS (HTTP Strict Transport Security) · Content-Security-Policy (CSP) · DMARC (Domain-based Message Authentication) · Cookie Consent (GDPR/ePrivacy) · SPF (Sender Policy Framework) · X-Frame-Options / frame-ancestors · llms.txt (AI Crawler Guidance) · all checks