Pink PostHow DKIM works
DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to every email you send. The sending server signs selected headers and the body with a private key; the receiver fetches the matching public key from DNS and checks the signature. If it verifies, the receiver knows the message came from a server holding your key and was not changed in transit.
The public key lives in a TXT record at selector._domainkey.yourdomain.com. The selector lets one domain have several keys, for example one for Google Workspace and one for a newsletter tool.
How to find your selector
- Send yourself an email from the mailbox you want to check.
- Open it and choose "Show original" (Gmail) or "View message source" (Outlook).
- Find the
DKIM-Signatureheader. Thes=value is the selector andd=is the signing domain.
Common defaults: Google Workspace google; Microsoft 365 selector1 and selector2 (CNAMEs to Microsoft); Mailchimp k1; SendGrid s1 and s2.
Key length and rotation
1024-bit RSA keys still verify, but 2048-bit is the current recommendation and the default in Google Workspace. Keys shorter than 1024 bits are rejected by major receivers. A record with an empty p= tag means the key has been revoked. Rotate keys every year or so; providers that use CNAME delegation rotate for you.
DKIM for outreach
DKIM is the authentication method that survives forwarding, which makes it the one DMARC relies on most. If you pitch from Google Workspace, DKIM signing stays off until an admin turns it on under Apps → Google Workspace → Gmail → Authenticate email. Check it here before you connect the mailbox to Pink Post.