What Is DKIM? How Email Signing Protects Your Domain
DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. Receivers use a public key published in your DNS to confirm the message really came from you and was not changed.
Selectors
DKIM keys live at selector._domainkey.yourdomain.com. The selector is a name your email provider picks, such as google or s1. You can find it in the DKIM-Signature header of an email you sent, after s=.
Key strength
RSA keys should be at least 2048 bits. Older 1024-bit keys are considered weak. Many providers let you rotate to a longer key from their admin panel.
Turning DKIM on
Most providers (Google Workspace, Microsoft 365, email marketing tools) generate the key for you. You copy the record they give you into your DNS, then switch signing on in their settings.
Check your key
Enter your domain and selector in DomainGuard to confirm the key is published, valid and long enough.