How to turn on DKIM

How DKIM works

Your email provider holds a private key and signs each outgoing message with it. You publish the matching public key in your DNS. When Gmail or Outlook receives your message, they look up that public key and check the signature. If it matches, the message passes DKIM.

DKIM matters more than people think. Unlike SPF, it survives forwarding, and it is the check that usually carries DMARC to a pass. Turning it on is a two-part job: publish the DNS records, then switch signing on with your provider.

Microsoft 365

Microsoft 365 uses two DNS records, both CNAMEs, named selector1._domainkey and selector2._domainkey. Two keys let Microsoft rotate them without breaking your mail.

1. Open the Microsoft Defender portal (security.microsoft.com) with an admin account.
2. Find the DKIM settings. Go to Email & collaboration, then Policies & rules, then Threat policies, then Email authentication settings, and open the DKIM tab. Microsoft moves menus now and then. If you get lost, search the portal for "DKIM".
3. Select your domain. The panel shows the two CNAME records Microsoft wants, with the exact values for your account. Copy them exactly. They are unique to you, so do not copy values from someone else's guide.
4. Add both CNAMEs in your DNS settings. Name selector1._domainkey pointing to the first value, and selector2._domainkey pointing to the second. If your DNS is at Cloudflare, leave the proxy off (gray cloud).
5. Go back to the DKIM panel and turn signing on for the domain. If it says the records cannot be found yet, wait a while and try again.

Google Workspace

Google uses one TXT record, normally at google._domainkey.

1. Sign in to the Google Admin console (admin.google.com) as a super admin.
2. Go to Apps, then Google Workspace, then Gmail, then Authenticate email.
3. Pick your domain and generate a new record. Choose the 2048-bit key if your DNS host accepts it (most do). Leave the prefix (selector) as google.
4. Add the TXT record in your DNS settings. Name google._domainkey, value is the long text Google shows, starting with v=DKIM1. Paste it as one piece.
5. Back in the Admin console, click Start authentication. If Google says it cannot find the record yet, give DNS time to update and try again.

GoDaddy email

For GoDaddy's own email products (such as Professional Email), DKIM is usually set up by GoDaddy when your domain's DNS is also at GoDaddy. To check, open your domain's DNS settings and look for a record whose name contains _domainkey.

• If you see one and the checkup still says DKIM fails, the record may be from an old provider. Compare it with what your current email setup expects.
• If there is none, or your DNS is somewhere else (like Cloudflare), contact GoDaddy support and ask for the DKIM record for your email so you can add it where your DNS lives.

Other services that send as you

Newsletter, booking and invoicing tools often have their own DKIM setup in their settings, usually called "domain authentication" or "authenticate your domain". It typically means adding two or three CNAME records they give you. Do it for each tool that sends mail with your address in the "From" line, or DMARC will flag that mail later.