Quick answer: DKIM (DomainKeys Identified Mail) signs every outgoing message with a private key on your server; receivers verify the signature against a public key you publish in DNS at selector._domainkey.yourdomain.com. Generate a 2048-bit key, publish the TXT record, and configure your MTA to sign.
Overview
DKIM proves a message was really sent by your domain and was not altered in transit. Large mailbox providers treat unsigned mail with suspicion, and DMARC builds directly on DKIM alignment — so a working DKIM setup is not optional for serious sending.
Before you start
- A working mail server (setup guide) — with Postfix, DKIM signing is usually done by
opendkimorrspamd. - Access to your domain's DNS zone.
Step-by-step guide
- Install and generate a key (OpenDKIM example):
apt install opendkim opendkim-tools opendkim-genkey -b 2048 -d yourdomain.com -s mail # creates mail.private (key) and mail.txt (DNS record) - Publish the contents of
mail.txtas a TXT record atmail._domainkey.yourdomain.com. - Point OpenDKIM at the key (KeyTable/SigningTable) and connect it to Postfix as a milter, then restart both services.
- Verify DNS:
dig +short TXT mail._domainkey.yourdomain.com - Send a test message and confirm
dkim=passin theAuthentication-Resultsheader. All-in-one stacks (Mailcow, docker-mailserver) generate the key for you — you only publish the DNS record.
Common issues
- Record too long: some DNS panels split a 2048-bit key into two quoted strings — paste it exactly as generated, or use the panel's multi-string field.
- Wrong selector: the selector in DNS (
mailabove) must match the one your MTA signs with. - dkim=fail after a migration: the private key did not move with the server — regenerate and republish.
When to contact support
DKIM is configured inside your OS and DNS, which on an unmanaged VPS is in your hands; open a ticket if you suspect a network-level issue instead, or need guidance on which parts belong to the server versus DNS.
Frequently asked questions
What key length should DKIM use?
Use a 2048-bit RSA key — it is the current standard accepted by all major providers; 1024-bit keys are considered weak and may be discounted by receiving filters.
What is a DKIM selector?
A label that lets a domain publish several DKIM keys at once. The signature names its selector, and receivers fetch the public key from selector._domainkey.yourdomain.com in DNS.
How do I confirm DKIM is working?
Send a message to a mailbox at a large provider and open the Authentication-Results header: it must show dkim=pass with your domain and the selector you configured.
Related articles
Need a hand? Contact Cloud2Y support →
