DKIM Record from A-Z: How To Check, Test & Generate DKIM

Spam lurks around every corner of cyberspace, and a staggering 91% of all cyberattacks begin with a phishing email to an unexpected victim. This research by Deloitte perfectly shows why it’s crucial to apply all possible safety measures to protect your domain from unwanted phishing attacks. And a DKIM record (DomainKeys Identified Mail) is among the most critical actions. 

The number of DKIM keys tripled from 2020 to 2021. And with cyber threats evolving at an alarming pace, it's no wonder that the adoption of DKIM records has skyrocketed.

So, in this article, we gathered everything about DKIM, along with expert advice from email deliverability experts on setting up this record. Read on and empower yourself with the knowledge that will keep your digital doors bolted shut.

What Is a DKIM Record?

Take a DKIM record like your passport: it helps you go through a face control and get into the recipient’s inbox. In simple words, it is a text record with your email signature used for the authentication of an email that’s being sent. It is essential to create both SPF records and DKIM as standards for email authentication that are used for DMARC alignment.

A DKIM record exists in the DNS, but it is a bit more complicated than SPF. DKIM’s advantage over SPF is that it can survive forwarding, which makes it superior to SPF and a foundation to save your email sender reputation. 

A DKIM record consists of a key pair. 

1. Public key. A public key is a TXT record added to your DNS record. Recipient servers can access it once you send a message and confirm that the sender’s address is valid and connected to the signature. 
   
2. Private key. This is a unique key. It’s added to your email signature. Your private key generates a DKIM signature for every email you send, ensuring that it won’t be copied or re-created by spoofers. 
   NB ❗ Although a receiving email server extracts your DKIM signature with a private key, nobody can see your unique private code. 
   

Why Is DKIM Check Crucial for Email Deliverability

When the recipient server uses a DKIM signature to verify an incoming email and establish if it was actually sent from the domain indicated in the email address, this process is called the DKIM check.  

• Helps to detect fake emails. By affirming the sender’s key, DKIM record helps to detect fake email addresses and fight against spam. 
• Helps to establish solid email reputation. Since DKIM ensure spammers don’t use your personal domain name to send emails, it’s a must-to-implement step for a solid domain reputation. As a result—more chances to get into inbox.
• Gives access to Postmasters. Postmaster Tools are Google Account services for analytics. They help to track data on large volumes of emails sent and find data about your sending domain. To set up postmaster statistics, you need to have the correct email authentication such as DKIM and SPF.

How DKIM Works in Practice

STEP 1: If DKIM record is set up property, sender’s domain adds e-signature to the email using private key + publishes txt DNS record containing public key. 

STEP 2: The receiving mail server extracts DKIM signature with private key from email header. 

STEP 3: The receiving mail validates a sender using a public key from a DKIM DNS entry.

STEP 4: If public and private keys match, the message goes to the user's inbox. If they don’t match, an email goes to a spam folder.

How To Check Your DKIM Record  

If you are a Microsoft 365 client, you can choose to do nothing about DKIM for your custom domain. Microsoft 365 automativally creates a private and public key pair, enables DKIM signing, and then configures the Microsoft 365 default policy for your custom domain.

❗However, if you answer “YES” to one of the following statements, it is important to manually configure your custom domain: 

1. You use more than one custom domain in Microsoft 365
2. You're going to set up DMARC as well (you can do it with free DMARC Record Generator)
3. You want have a 100% control over your private key
4. You want to have customized CNAME records
5. You want to set up DKIM keys for email originating out of a third-party domain, for example, if you use a third-party bulk mailer.

So, here’s a quick guide to check your DKIM setup: 

1. Send a message from your Microsoft 365 account with DKIM-enabled domain to another email account such as Outlook.com.
2. Open the email and look at the header. The correctly DKIM-signed message will show the hostname and domain. The message will look like this:
   

How to generate DKIM in G-suite

If you DKIM test has failed or/and you want to create a customized DKIM record, follow the next steps in your G-Suite account.

1. Open your Google Admin console (at admin.google.com).

2. Go to Apps > G Suite > Gmail or follow the search request below.

a) Type DKIM and go to DKIM authentication.

b) On the Authenticate email page in the drop-down list, select a domain for DKIM authentication.

3. Click Generate New Record to generate DKIM record.

4. Select DKIM 2048-bit key (The “2048-bit” is the length of the key, which determines its strength. The longer key means enhanced security) and click Generate.

5. After the generation is complete, go to the domain registrar (where you manage DNS records) and add the TXT type record with the following Host name and record value:

When the record in the domain registrar is saved go back to the Google Admin and click the Start Authentication button.

Conclusion: Navigating the Intricacies of DKIM

Implementing DKIM not only safeguards your brand's reputation but also enhances email deliverability. It’s a vital layer of protection against phishing attempts, email spoofing, and other fraudulent activities, bolstering your overall email security.

However, it's crucial to remember that DKIM implementation is not a one-size-fits-all approach. Each organization may have specific requirements and nuances that require expert guidance.

If you need assistance or further insight into email deliverability best practices, fear not. Our team of email deliverability experts at Folderly is here to provide you with comprehensive consulting services tailored to your unique needs. We have the knowledge and expertise to help you navigate the intricacies of DKIM and other email authentication methods, ensuring your emails reach their intended destinations.

Also, should you have any questions or concerns regarding DKIM or any other email-related matters, please don't hesitate to contact us at support@folderly.com. We are dedicated to assisting you in your journey towards optimized email deliverability and unrivaled sender reputation.