Enable DKIM signing

Publish your provider's signing key so your mail carries a verifiable signature.

20 min

why this matters

DKIM survives forwarding, which SPF does not. Unsigned mail is far more likely to be filtered, and DMARC needs DKIM to pass reliably.

1
Generate the key in your email provider
In Google Workspace this is Apps → Google Workspace → Gmail → Authenticate email. In Microsoft 365 it is the Defender portal's DKIM page. Marketing platforms have a domain authentication screen. Ask for a 2048-bit key.
2
Publish the record they give you
It is a TXT or CNAME record on a selector subdomain. Copy the value exactly — a single missing character breaks the signature.
```
Type: TXT
Name: google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkq...
```
3
Turn on signing
Publishing the key does nothing until you click 'Start authenticating' or the equivalent in the provider. DNS needs up to an hour to propagate first.
4
Repeat for every sending service
Each platform gets its own selector. Do your marketing tool, helpdesk and invoicing system too, not just your mailbox provider.