I’ve set up DKIM on dozens of domains. Every time I skip a step or rush it, something breaks, and emails silently land in spam for days before anyone notices.

Here’s what makes DKIM worth the 15 minutes: starting in February 2024, Google and Yahoo began requiring bulk email senders to authenticate emails with both SPF and DKIM (Google & Yahoo Email Authentication Requirements For Bulk Senders | Valimail Help Center). If you send outreach at any real volume and your DKIM isn’t configured, your emails are getting throttled or rejected right now.

In this post, I’ll walk you through exactly how to set up DKIM for your domain, step by step, for every major email and domain provider. I’ll also cover the key-length standards you should follow, the most common setup mistakes I see, and how to verify everything is working.

DKIM (DomainKeys Identified Mail) is an email authentication protocol that attaches a cryptographic digital signature to every outgoing message. It lets the recipient’s email server verify two things: the email actually came from your domain, and nothing was altered in transit.

You publish a public key in your domain’s DNS records. Your email server holds the matching private key and uses it to sign outgoing messages. When a recipient’s server gets your email, it pulls the public key from DNS, checks the signature, and either passes or fails the message.

That’s it. No certificate authority, no third-party middleman. You own the keys, you manage them in DNS.

SPF, DKIM, and DMARC work together to certify that you’re the sole owner of your sending domain.

SPF tells receivers which servers are allowed to send on your behalf. DKIM proves the message content hasn’t been tampered with. DMARC ties them together with a policy that tells receivers what to do when checks fail.

For cold emailing, this trio matters more than almost anything else in your technical setup. When your emails are authenticated, they’re less likely to be marked as spam or rejected outright. That directly increases inbox placement, which means more replies, more meetings, more pipeline.

If you’re using lemlist’s Deliverability setup, most of this authentication is automated for you during domain configuration, so you don’t have to manually piece together every DNS record.

As part of the lemlist academy’s free training, we offer an entire module on avoiding the spam folder when using lemlist.

Yes. And this is the biggest reason DKIM matters more in 2026 than it ever has before.

Google and Yahoo introduced email authentication requirements for bulk message senders, impacting those who send more than 5,000 emails per day. To follow the new requirements, bulk senders need to deploy SPF, DKIM, and DMARC, enable easy unsubscription, and focus on message relevance. (Google and Yahoo Updated Email Authentication Requirements for 2025 - Security Boulevard)

In their latest email guidelines, Google enforced email authentication deployments starting in February 2024. (Google and Yahoo Updated Email Authentication Requirements for 2025 - Security Boulevard) As of November 2025, these requirements have been enforced, with Google stating that non-compliant emails will face temporary and permanent rejections. (Google and Yahoo Updated Email Authentication Requirements for 2025 - Security Boulevard)

Google defined bulk senders as “those who send more than 5,000 messages to Gmail addresses in one day.” (Bulk email restrictions from Google, Yahoo, and Microsoft: What you need to know | MarTech) Senders who meet this criteria at least once are permanently considered bulk senders. (Google & Yahoo Email Authentication Requirements For Bulk Senders | Valimail Help Center)

Even if you’re under the 5,000/day threshold for Gmail, Yahoo did not specify a volume threshold and will classify as a bulk sender any domain sending a significant volume of emails to personal Yahoo accounts. (Google & Yahoo Email Authentication Requirements For Bulk Senders | Valimail Help Center)

Bottom line: if you do any kind of outbound at scale, DKIM isn’t optional. It’s table stakes. You can read more about Google and Yahoo’s bulk sender requirements directly from Google’s documentation.

Here’s the flow:

DKIM stores the public key in DNS so you manage the keys yourself. No reliance on third-party certificate authorities.

This is a detail many guides skip, and it matters.

RFC 8301 states that signers should use RSA keys of at least 2048 bits, and verifiers must be able to validate signatures with keys ranging from 1024 bits to 4096 bits. (RFC 8301 - Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM))

1024-bit RSA is deprecated by RFC 8301 and falls below NIST minimums, yet hosting panels like cPanel still generate it by default. (DKIM Key Length: 1024 Vs 2048 Vs 4096 (2026)) So if you set up DKIM using a default wizard and never checked the key length, you might be running a deprecated key right now.

Google’s sender guidelines recommend 2048-bit keys for security. (DKIM Key Length: 1024 Vs 2048 Vs 4096 (2026)) 2048-bit RSA is the right default for 2026, satisfying RFC 8301, NIST, and the Google and Yahoo bulk sender requirements. (DKIM Key Length: 1024 Vs 2048 Vs 4096 (2026))

One thing to watch: a 2048-bit public key exceeds the 255-byte DNS TXT limit, so you must split it into chunked strings or verification fails silently. (DKIM Key Length: 1024 Vs 2048 Vs 4096 (2026)) Most DNS providers handle this automatically, but verify after publishing.

When you generate your DKIM key, always select 2048-bit if your provider offers the option. Google Workspace defaults to 2048-bit. Microsoft 365 also supports it.

No matter which mail server you use, setting up DKIM follows the same pattern:

Similar to SPF, DKIM uses DNS TXT records. If you need help with SPF, check out our SPF record setup guide.

Rotate keys every 6 to 12 months using a parallel selector (DKIM Key Length: 1024 Vs 2048 Vs 4096 (2026)), then retire the old record once propagation is verified. The process involves adding new keys alongside the old ones, confirming the new keys work, and only then removing the old records from DNS.

To make this easier, I’ve organized all tutorials into two groups: Google and Microsoft Office. Plus a GoDaddy-specific walkthrough, since it’s the most widely used registrar.

⬇️⬇️⬇️

Google Workspace makes DKIM setup straightforward. You can follow Google’s official DKIM setup guide for the most current admin console navigation, but here’s the walkthrough.

To set up Google Workspace DKIM record, you need to get a unique record from Google. Go to Apps → Google Workspace → Gmail → Authenticate email:

Now click “Generate new record” and copy the hostname and TXT record value:

Now you need to:

To set up a DKIM record, you need to get a unique record from Google, and to do that we need to go to Apps → Google Workspace → Settings for Gmail → Authenticate email:

Now click “Generate new record” and copy the hostname and TXT record value:

Now come back to Google Workspace and click “Start authentication”:

To set up a DKIM record, you need to get a unique record from Google, and to do that we need to go to Apps → Google workspace → Settings for Gmail → Authenticate email:

Now click “Generate new record” and copy the hostname and TXT record value:

Now come back to Google Workspace and click “Start authentication”:

To set up a DKIM record, you need to get a unique record from Google, and to do that we need to go to Apps → Google Workspace → Settings for Gmail → Authenticate email:

Now click “Generate new record” and copy the hostname and TXT record value:

Now come back to Google Workspace and click “Start authentication”:

To set up a DKIM record, first generate the key in Google Workspace. Go to Apps → Google Workspace → Settings for Gmail → Authenticate email. Click “Generate new record” and copy the hostname and TXT record value.

Then:

GoDaddy DNS changes typically propagate within 1–4 hours, though it can take up to 48 hours. (DKIM for GoDaddy: Setup and DNS Configuration)

Once propagation is complete, go back to Google Workspace and click “Start authentication.”

One GoDaddy-specific note: GoDaddy handles long TXT values automatically. When you paste a long TXT value, GoDaddy splits it into 255-character chunks behind the scenes. (DKIM for GoDaddy: Setup and DNS Configuration) So you shouldn’t need to manually split 2048-bit key records.

Microsoft Office is your preferred choice? I’ve got you covered. You can also reference Microsoft’s DKIM documentation for the latest Defender portal navigation.

DKIM setup for Microsoft is a bit different than Google. Let’s walk through it.

In order to set up a DKIM record, you need to get a unique record from Exchange, and to do that we need to go to Home → Policy → DKIM.

Select the domain for which you want to enable DKIM and then, for Sign messages for this domain with DKIM signatures, choose Enable. Repeat this step for each custom domain.

To set up a DKIM record, you need to get a unique record from Exchange, and to do that we need to go to Home → Policy → DKIM.

Select the domain for which you want to enable DKIM and then, for Sign messages for this domain with DKIM signatures, choose Enable. Repeat this step for each custom domain.

To set up a DKIM record, you need to get a unique record from Exchange, and to do that we need to go to Home → Policy → DKIM.

Select the domain for which you want to enable DKIM and then, for Sign messages for this domain with DKIM signatures, choose Enable. Repeat this step for each custom domain.

To set up a DKIM record, you need to get a unique record from Exchange, and to do that we need to go to Home → Policy → DKIM.

Select the domain for which you want to enable DKIM and then, for Sign messages for this domain with DKIM signatures, choose Enable. Repeat this step for each custom domain.

To set up DKIM for Microsoft 365 with GoDaddy:

To verify your DKIM setup, follow these steps:

Ensure that the DKIM public key has been added to your DNS records. This typically involves creating a TXT record or a CNAME record with your DNS provider.

Send a test email from the domain where DKIM has been set up to an external email address, preferably one you can use for checking headers (like Gmail).

In the received test email, view the email headers. This is usually done through the “View Original” or “View Source” option in the email client.

Look for a header field named DKIM-Signature.

In the email headers, search for the Authentication-Results header, which indicates the result of the DKIM check.

A successful DKIM validation result looks like:

If the result is pass, DKIM is set up correctly and the signature was validated.

Use these online tools to validate your DKIM setup:

Alternatively, for a simple and quick check, use our technical setup checker below:

window.addEventListener(‘message’, function(event) { if (event.data.from == “iframe” && event.data.action == “resize”) { let iframe = document.getElementById(“myIframe”); iframe.style.height = (event.data.height + 10) + “px”; } });

Verify that the DKIM public key is correctly published in your DNS records. You can use DNS lookup tools or commands like nslookup or dig to ensure the TXT or CNAME record exists and is formatted correctly.

You can also use DMARC aggregate reports to confirm that messages sent from your domain are correctly authenticated with DKIM and SPF. These reports tell you which messages pass and which fail, broken out by sending source.

For ongoing monitoring, lemlist’s Deliverability Hub lets you track inbox placement continuously and catch authentication failures before they snowball. You can also set up continuous deliverability monitoring to get alerts when something breaks.

I’ve debugged enough DKIM failures to know: most of them are caused by small, dumb mistakes that are easy to fix once you know where to look. Here are the ones I see most often.

Misplaced or incorrectly formatted TXT records can cause public key retrieval failures. (Common DKIM Setup Errors and Fixes) Your DKIM record must be published at selector._domainkey.yourdomain.com. Even a small mistake, like a missing semicolon or an incorrectly formatted public key, can invalidate the record. (Common DKIM Setup Errors and Fixes)

Fix: Use a DKIM record generator instead of manually building the record. Copy-paste the values directly into your DNS management console to avoid transcription errors.

The selector in your email header must match the one in your DNS record exactly. For example, if your email service uses “default” as the selector but your DNS record uses “mail”, DKIM verification will fail. (Common DKIM Setup Errors and Fixes)

Fix: Check the email headers of a sent message to confirm which selector your provider is using. Make sure your DNS record uses that same selector.

A DKIM signature can fail even when the key setup is correct if the message changes after signing. Confirm that no downstream system is modifying the body or signed headers after DKIM is applied. (DKIM Fail: Causes, Errors & How to Fix | Mimecast) The usual culprit is a security gateway or mailing list appending a footer or disclaimer after DKIM signed the message. (DKIM fail: Reasons, types, examples, and how to fix it)

Fix: Switch DKIM canonicalization from simple/simple to relaxed/relaxed, which tolerates minor whitespace and header changes without breaking the signature. (DKIM fail: Reasons, types, examples, and how to fix it)

Updates to DNS records may take hours to reflect globally, causing temporary failures. (Common DKIM Setup Errors and Fixes) I once spent 45 minutes troubleshooting a “missing record” error that resolved itself two hours later. Just DNS doing its thing.

Fix: After updating DKIM records, wait at least 24–48 hours before testing. Use multiple DNS lookup tools from different locations to verify record propagation. (Troubleshooting Issues with DKIM)

Outdated keys can invalidate email authentication. (Common DKIM Setup Errors and Fixes) If you set up DKIM two years ago and never touched it, now is the time.

Fix: Rotate keys every 6–12 months. Publish the new key under a new selector, test it, then retire the old one. Don’t remove the old key until you’ve confirmed the new one is passing validation.

A common mistake is setting up DKIM for your primary email provider but forgetting about the other tools in your stack. These improperly configured third-party vendors are a frequent source of DKIM failures. (Solving DKIM Issues: Practical Troubleshooting)

Fix: Audit every service that sends email on your behalf (marketing platforms, transactional email, support tools). Each one needs its own DKIM selector and DNS record.

Email spoofing is a tactic used to deceive recipients into believing that an email comes from a legitimate source when it’s actually a fraudulent attempt to steal sensitive information.

DKIM helps fight spoofing by using cryptographic signatures to verify that an email message has not been tampered with and that it truly comes from the claimed domain. Working alongside SPF and DMARC, it forms a defense layer that makes it significantly harder for attackers to impersonate your domain.

The recipient’s mail server checks the DKIM signature against the public key in your DNS. If the signature doesn’t match, or if there’s no key to check against, the message gets flagged. Combined with a DMARC policy set to quarantine or reject, spoofed emails using your domain get blocked before they ever reach an inbox.

For a deeper dive into protecting your domain, check out our DMARC setup guide.

DKIM setup takes 15 minutes. Fixing the deliverability damage from not having it takes weeks.

Here’s what to do right now:

If you want to skip the manual DNS work, lemlist’s Deliverability setup automates DKIM, SPF, and DMARC configuration during domain onboarding. And lemwarm keeps your sender reputation healthy once you’re authenticated.

lemlist is rated 4.6/5 on G2 from 2,000+ reviews.