DKIM Record Examples: Real-World Samples and Formats

Understanding what a DKIM record looks like helps you verify your configuration is correct and troubleshoot issues. This guide shows real DKIM record examples from popular email services and explains each part.

DKIM Record Format

Every DKIM record follows this basic structure:

selector._domainkey.domain.com IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY"

Let's break down each component:

| Part | Meaning | Example | |------|---------|---------| | selector | Identifier for this specific key | google, k1, selector1 | | _domainkey | Required literal string | Always _domainkey | | domain.com | Your domain | example.com | | v=DKIM1 | DKIM version (required) | Always DKIM1 | | k=rsa | Key type | Usually rsa | | p= | Public key (base64 encoded) | Long string of characters |

Google Workspace Example

Google Workspace uses the selector google (and google2 after rotation).

DNS Record Name:

google._domainkey.example.com

Record Type: TXT

Record Value:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8JxoVKI3jMH7Dq7i4W8xKbDrl9sQjPXrQ2VpMSY3n0t8IKCBR0T3d4+HaGqK5Dez18vW2UJ4W9A7HqPmj6LMZTrq0KD5hNZuQg3N4V7KZ5fIJ5W8q3a7q3N3c3bV2P5xKrJ1d8qcJSXq7Y3LKj4Z8RqJzK4Q5yV3mJK2N9Y3D7xPQO8qF5KrL2d8q3P5nKcZ7V2x8JqL4mN9Y3xP7Q2R5T8kL2qJ9Y4M7xN3V5P8Q2rK9Y4mLz

Microsoft 365 Example

Microsoft 365 uses CNAME records pointing to Microsoft's key servers, not direct TXT records.

DNS Record Name:

selector1._domainkey.example.com

Record Type: CNAME

Record Value:

selector1-example-com._domainkey.contoso.onmicrosoft.com

Microsoft also requires a second record:

DNS Record Name:

selector2._domainkey.example.com

Record Type: CNAME

Record Value:

selector2-example-com._domainkey.contoso.onmicrosoft.com

Mailchimp Example

Mailchimp uses selectors like k1, k2, or k3.

DNS Record Name:

k1._domainkey.example.com

Record Type: CNAME (preferred) or TXT

CNAME Value:

dkim.mcsv.net

Or TXT Value:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHVCxrp2ocoTgYnhZmLqLe9JK8IFj3kC7SlSgNEpYPz4hRdNz5AOF0K2j4H7u1Rn1U8wLU9D3qpKg8LqJG4T3E5V2xjK9QZ3ePnSxq7z4xQ8T3bF2qS8JqZcKy7P5jK2L8x4nH9Q2rK5pT8mLj...

SendGrid Example

SendGrid uses selectors like s1 and s2.

DNS Record Name:

s1._domainkey.example.com

Record Type: CNAME

Record Value:

s1.domainkey.u12345678.wl123.sendgrid.net

The exact value includes your SendGrid account identifier.

Amazon SES Example

Amazon SES generates unique selectors for each domain.

DNS Record Name:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx._domainkey.example.com

Record Type: CNAME

Record Value:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.dkim.amazonses.com

Amazon SES creates three DKIM records with different selectors for redundancy.

Postmark Example

Postmark uses date-based selectors.

DNS Record Name:

20240101._domainkey.example.com

Record Type: TXT

Record Value:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Zoho Mail Example

Zoho uses the selector zmail.

DNS Record Name:

zmail._domainkey.example.com

Record Type: TXT

Record Value:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD...

1024-bit vs 2048-bit Key Examples

The main visible difference is key length.

1024-bit key (shorter):

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2W9qzPH1dRx6yt4jK9p3qL2n5M8a7R6s4T1u2V3w4X5y6Z7a8B9c0D1e2F3g4H5i6J7k8L9m0N1o2P3q4R5s6T7u8V9w0X1y2Z3a4B5c6D7e8F9g0H1i2J3k4L5m6N7o8P9q0R1s2T3u4V5w6X7y8Z9==

2048-bit key (longer, recommended):

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8JxoVKI3jMH7Dq7i4W8xKbDrl9sQjPXrQ2VpMSY3n0t8IKCBR0T3d4+HaGqK5Dez18vW2UJ4W9A7HqPmj6LMZTrq0KD5hNZuQg3N4V7KZ5fIJ5W8q3a7q3N3c3bV2P5xKrJ1d8qcJSXq7Y3LKj4Z8RqJzK4Q5yV3mJK2N9Y3D7xPQO8qF5KrL2d8q3P5nKcZ7V2x8JqL4mN9Y3xP7Q2R5T8kL2qJ9Y4M7xN3V5P8Q2rK9Y4mLzKjPQ8nM3X5V7y9R2T4wK6pL8qJ0Y2N4M6xP8Q0R2T4V6X8y0Z2B4D6F8H0J2L4N6P8Q0R2T4V6X8==

Optional DKIM Parameters

Some DKIM records include additional parameters:

v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

| Parameter | Meaning | |-----------|---------| | t=y | Testing mode—signals this key is being tested | | t=s | Strict mode—domain must match exactly (no subdomains) | | h=sha256 | Specifies acceptable hash algorithms | | s=email | Service type (rarely used) |

What a Complete Setup Looks Like

For a domain using Google Workspace and Mailchimp, you'd have:

DNS Records:

| Type | Host | Value | |------|------|-------| | TXT | google._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkq... | | CNAME | k1._domainkey | dkim.mcsv.net |

Both records can coexist because they use different selectors.

Validating Your Records

After adding DKIM records, verify them:

1. Check DNS resolution: Use our lookup tool to confirm the record is published
2. Verify the format: Ensure v=DKIM1 is present and the key isn't truncated
3. Test with real email: Send an email and check the Authentication-Results header

If you need to generate a new DKIM record, dkimcreator.com can help.

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.