What it is
DKIM adds a digital signature to every outgoing message using a private key held by your mail provider. The matching public key is published in your DNS. A receiver fetches that public key, verifies the signature, and now knows two things: the message genuinely came from your domain, and nothing in the signed portion has been changed since.
Selectors
A domain can have many DKIM keys, so each one is filed under a label called a selector. Google Workspace typically uses google, so the key lives at google._domainkey.yourdomain.com. The selector is included in the signature header of every message, which is how a receiver knows which key to fetch.
This matters at scale. If a domain sends through two providers it needs two keys under two selectors. A mailbox pool provisioned in a hurry can end up with none at all, and the only symptom is worse placement.
Why it beats SPF for forwarded mail
When a message is forwarded, the forwarding server becomes the sender, so SPF breaks — the new sending IP is not on your list. DKIM does not care. The signature travels with the message and still verifies, as long as the signed content was not modified. This is why DKIM is the more reliable of the two signals.
Check yours
These run free in your browser. Nothing you type reaches a server.
Common questions
What key length should I use?
2048-bit. 1024 is still accepted but is being phased out and some receivers now treat it as weak. The main practical annoyance with 2048 is that the record is too long for a single DNS TXT string and has to be split into chunks.
Do I need a DKIM key for every sending domain?
Every domain you send from needs DKIM published for it. Whether that is a distinct key or a provider key published across domains depends on the provider — Google Workspace generates per-domain keys automatically.
Should I rotate DKIM keys?
Periodically, yes — annually is a reasonable rhythm. Publish the new key under a new selector, let both run briefly, then switch signing over and retire the old selector.
Related concepts
If this is the thing going wrong
The pages explain it. If you would rather it was simply fixed, that is the work I do.