Glossary

What is DKIM?

DKIM, short for DomainKeys Identified Mail, adds a digital signature to every email you send. The receiving server uses a public key published in your domain's DNS to check that the message really came from your domain and was not changed on the way. Mailbox providers expect it, and it is part of passing DMARC.

Published by Sellinger AI. Numbers and settings checked on 24 October 2026 against the fact register. Report an error.

How does DKIM work?

Your mail server signs each outgoing message with a private key and adds the signature to the message header. You publish the matching public key in DNS, at an address made of a selector and your domain, for example selector._domainkey.yourdomain.com. The receiver fetches the key, checks the signature and records whether it passed.

Because the signature covers parts of the message, a pass shows the mail was not altered in transit. A fail can mean a forged message, or simply a forwarding service that changed the content.

What key length should you use?

Google's email sender guidelines say mail to personal Gmail accounts must be signed with a key of 1024 bits or longer, and recommend 2048 bits where your provider supports it. Most mailbox providers let you generate the key in their admin console and give you the DNS record to publish.

What are common DKIM mistakes?

Turning DKIM on in the admin console but never publishing the DNS record.
Publishing the key on the wrong host name, for example missing the selector.
Signing with one domain while the visible From uses another, which then fails DMARC alignment.
Forgetting to sign mail from a second sending service, such as a newsletter tool.

How Sellinger handles it

Sellinger sends from your own connected Gmail or Outlook mailbox. It does not set up or check your domain records, run inbox placement tests or monitor your domain, so you or your IT provider set up SPF, DKIM and DMARC at the domain. In Google Workspace and Microsoft 365 you turn DKIM on in the admin settings and publish the record they give you.

Cold email can carry an unsubscribe line and the standard one click unsubscribe headers (List-Unsubscribe and List-Unsubscribe-Post). It is a per mailbox setting.

Common questions

Do I need DKIM for cold email?

Yes. Google and Yahoo both list DKIM among their sender requirements, and it is part of passing DMARC.

What is a DKIM selector?

A label that lets one domain publish several keys, for example one per sending service. It appears in the DNS host name and in the signature.

Does DKIM stop spoofing?

Not alone. DMARC tells receivers what to do when DKIM and SPF do not match the From domain.

Sources and method

Google email sender guidelines, read 19 October 2026 for the linked blog post. Sellinger behaviour from the fact register, checked 24 October 2026.