What is DKIM?DKIM (DomainKeys Identified Mail) is an email authentication mechanism that uses public-key cryptography to provide a verifiable proof that an email was sent by an authorized sender for the claimed domain and that the email content was not tampered with during transit. When an email is sent, the sending server generates a
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication mechanism that uses public-key cryptography to provide a verifiable proof that an email was sent by an authorized sender for the claimed domain and that the email content was not tampered with during transit. When an email is sent, the sending server generates a cryptographic hash of the email content and signs it with a private key. The receiving server looks up the corresponding public key in your domain DNS records and uses it to verify the signature. If the signature matches, the email passes DKIM authentication.
DKIM Implementation for SaaS Email
DKIM configuration varies by email provider but follows the same basic process: (1) Your email service provider (Google Workspace, SendGrid, Mailchimp, Postmark) generates a public/private key pair. (2) You add the public key as a DNS TXT record on your sending domain (the record name is typically something like google._domainkey.yourdomain.com). (3) The email provider uses the private key to sign each outgoing email. (4) Receiving servers verify the signature using the public key in your DNS. Each sending service requires its own DKIM record: if you send email from G-Suite, SendGrid, and a cold outreach tool, each needs its own DKIM DNS record configured.
Frequently Asked Questions
Does DKIM affect email delivery to Gmail?
Yes, significantly. Gmail and other major email providers (Yahoo, Microsoft) use DKIM as a key deliverability signal: emails with valid DKIM signatures are more trusted and more likely to be delivered to the inbox rather than spam. Gmail bulk sender requirements (for senders sending more than 5,000 emails per day to Gmail addresses) explicitly require DKIM authentication. Even for lower-volume senders, missing DKIM is a significant spam risk factor that reduces inbox placement rates.
What is DKIM key size and which should I use?
DKIM keys come in two primary sizes: 1024-bit and 2048-bit. Google and email security experts now recommend 2048-bit DKIM keys as the security standard: 1024-bit keys are considered potentially vulnerable to brute-force attacks by sophisticated adversaries. When setting up new DKIM configurations, always request 2048-bit key generation from your email provider. If you have existing 1024-bit DKIM keys, rotate them to 2048-bit during your next email infrastructure review. DKIM key rotation (generating new keys periodically) is also recommended security practice.