Why Your Domain Needs a DKIM Key Pair in 2026

You send an email to a client. It lands in their spam folder—or worse, it vanishes without a trace. You didn’t send it wrong. The problem isn’t your message. It’s that your domain lacks a DKIM key pair.

DKIM is the digital fingerprint that proves your emails were actually sent from your domain—and not spoofed. Without it, even a well-written message can be rejected by Gmail, Outlook, or other major providers.

Today’s email ecosystem demands not just that you send emails, but that you prove you're the real sender. DKIM is one of the core technical requirements for earning and maintaining inbox trust.

Key takeaways

  • DKIM signs each outgoing email with a cryptographic key pair to verify sender authenticity.
  • Domains without DKIM are more likely to have emails marked as spam or blocked by providers like Gmail and Outlook.
  • Generating a DKIM key pair is a one-time setup step that protects your domain’s deliverability and reputation.

How DKIM Works with Your Email Domain

When you send an email from your domain, your mail server uses a private key to generate a digital signature. The receiving server checks your domain’s DNS for a matching public key (published as a TXT record) and validates the signature. A successful match proves the email wasn’t tampered with and genuinely came from your domain. This is how DKIM ensures email integrity and authenticity across the internet.

Signing and Verifying Email

Every time you send an email, your server applies a cryptographic signature using a private key stored securely on your mail server. This signature is unique to that message and includes parts of the email header, like the sender address and message ID.

When the recipient’s server receives the email, it pulls your domain’s public key from DNS. It uses that key to verify the signature. If the math checks out, the email is trusted as authentic and unaltered. If not, the domain’s reputation may suffer, and the email could be flagged as spam.

DKIM in Practice: DNS and Keys

The public key lives in a DNS TXT record under a specific selector (e.g., default._domainkey.yourdomain.com). The selector is chosen by you during setup and identifies which key pair to use. You can have multiple selectors for different systems or phases.

If you use Unifiedesk, the process is handled automatically—you can set up custom domains with full DKIM signing in minutes. The platform generates and manages your DKIM keys for you, publishing the public key in DNS via a TXT record, so you don’t need to manage it manually. Set up your domain and let Unifiedesk handle the rest.

It's common to see DKIM used in conjunction with SPF and DMARC for layered email security. These three standards together help receiving servers determine if an email is legitimate and reduce the risk of spoofing.

For details on how DKIM is implemented across the industry, the IETF’s RFC 6376 defines its specifications. Similarly, major email providers like Google and Microsoft rely on DKIM to filter incoming messages. As of recent reports, over 70% of major email providers check DKIM signatures before delivery.

How to Generate a DKIM Key Pair Using opendkim-genkey

You can generate a DKIM key pair with the opendkim-genkey command on Linux systems that have OpenDKIM installed. It creates a private key (stored securely on your mail server) and a public key (published as a DNS TXT record). This standardized tool is widely supported by mail servers and receivers, making it the industry-standard way to set up DKIM.

What opendkim-genkey Does, and Why It Matters

When you run opendkim-genkey, it produces two files: one with the private key, which must stay on your server and never be exposed, and another with the public key, which you’ll publish in your domain’s DNS records. This is how receivers verify that an email genuinely came from your domain and wasn’t tampered with in transit.

Using this tool ensures compatibility across senders and receivers. Major providers like Gmail, Outlook, and Yahoo rely on DKIM, and standardizing on tools like opendkim-genkey means your setup will work with the vast majority of email infrastructure. It’s listed in RFC 6376 — the official specification for DKIM — for good reason.

How to Use opendkim-genkey in Practice

Let’s say you’re setting up email for yourdomain.com. Run opendkim-genkey -d yourdomain.com -s default on your mail server. This creates two files: default.private (keep this safe) and default.txt (copy its contents into DNS).

Then, add a TXT record to your domain’s DNS zone: default._domainkey.yourdomain.com with the value from default.txt. You can verify this using tools like MXToolbox or RFC 6376, both trusted resources in email infrastructure.

Once published, your outbound mail will be signed automatically by your MTA (Mail Transfer Agent) if configured correctly. Receiving servers will check the DKIM signature using your public key, reducing spam and improving deliverability.

If you're using Unifiedesk, all outbound mail is DKIM-signed automatically for domains you add — no manual key generation needed. You can manage domains, set up signing, and view records in minutes at your dashboard. For full control and data residency, consider the self-hosted option, where you manage your own DKIM keys.

Step-by-Step: Generate a DKIM Key Pair with opendkim-genkey

You can generate a DKIM key pair for your domain using the opendkim-genkey tool. Install OpenDKIM on your server, then run opendkim-genkey -d yourdomain.com -s default. This creates a private key and a TXT record you’ll publish in your DNS. The private key stays secure on your server; the public key is added to DNS so recipients can verify your emails. This is a standard practice for proving email authenticity and reducing spam.

Install OpenDKIM

Start with the OpenDKIM package. On Debian or Ubuntu, run: sudo apt install opendkim. This installs the tools you need to generate and manage DKIM records. The package is well-maintained and widely used in email infrastructure.

Generate the Key Pair

  1. Log in to your email server as root or a user with sudo privileges.
  2. Run opendkim-genkey -d yourdomain.com -s default, replacing yourdomain.com with your actual domain.
  3. After the command finishes, you’ll get two files: default.private (your private key) and default.txt (the public key TXT record).
  4. Do not share or expose default.private. It must remain secret on your server, protected from unauthorized access.
  5. Copy the entire content of default.txt—it begins with default._domainkey IN TXT and ends with a closing quote.

Add the Public Key to DNS

Paste the content from default.txt into a new TXT record in your domain’s DNS settings. The record name should be default._domainkey. This allows receiving mail servers to verify your domain’s authenticity using RFC 6376, the standard for DKIM.

Once published, it may take a few minutes to propagate. You can check the result using tools like MXToolbox or DMARC Analyzer.

DKIM helps ensure that emails sent from your domain haven’t been altered in transit, protecting recipients from spoofing.

If you’re using a service like Unifiedesk, you can manage custom domains and record setup with full privacy and control. For more on hosting your workspace with encryption and compliance, see our self-hosted option.

Where to Place the DKIM Public Key in Your Domain’s DNS

You add the DKIM public key as a TXT record in your domain’s DNS, with the name default._domainkey.yourdomain.com and the full key content from your default.txt file as the value. This tells receiving mail servers how to verify your domain’s signed emails. It’s a crucial step in preventing spoofing and improving deliverability.

Step-by-step: Adding the DKIM TXT Record

  1. Log in to your domain registrar or DNS provider — whether that’s Cloudflare, AWS Route 53, GoDaddy, Namecheap, or another service. You need access to your domain’s DNS zone.
  2. Create a new TXT record with the name default._domainkey.yourdomain.com. Replace yourdomain.com with your actual domain. This name follows the standardized DKIM record format used across the industry.
  3. Paste the full public key from the default.txt file generated earlier. Do not trim whitespace, line breaks, or quotes. The entire content — usually a long string starting with v=DKIM1; k=rsa; p= — must be copied exactly.
  4. Save the record. DNS changes can take up to 48 hours to propagate globally, though most email providers pick up the change within a few hours. You can test with tools like MXToolbox’s DKIM Checker or DMARCian’s DKIM Validator.
  5. Verify it’s live with DNS lookup tools. The record must be reachable and correctly formatted. Incorrect syntax will break DKIM verification and hurt your domain’s sending reputation.

Why This Matters for Your Email Security

DKIM is a technical fingerprint that proves an email wasn’t altered in transit. When receiving servers validate your DKIM signature using the public key in DNS, they can confidently reject forged messages. According to RFC 6376 (the standard for DKIM), this mechanism is foundational to modern email authentication.

Once set, your domain is protected against impersonation. This is especially critical when using services like Unifiedesk to send or receive email. With email and workspace suite built with privacy in mind, you can control the full stack — from encryption to authentication — across mail, calendar, video meetings, and file storage.

And if you're managing many domains, or need full data control, Unifiedesk supports custom domains with automatic DNS records — including DKIM, SPF, and DMARC — generated in minutes. Learn more about setting up your domain here, or try the hosted or self-hosted option with full privacy at your own server.

How Unifiedesk Handles DKIM Key Generation for Your Domain

You don’t need to run opendkim-genkey manually. When you add a custom domain in the Unifiedesk dashboard, it automatically generates a secure DKIM key pair and provides the exact DNS TXT record you need. Just copy it to your domain registrar, and your outbound emails are signed by default—improving deliverability and authenticity across inboxes.

Automated, Secure, and Built for Real Use Cases

Let’s be clear: DKIM key generation isn’t meant to be a manual task you do over SSH. With Unifiedesk, the process is handled in the background, so you focus on your work, not cryptographic keypairs. Whether you're using our hosted service or deploying self-hosted, the system creates a valid DKIM key pair using industry-standard protocols, and it’s ready to use immediately.

Once you’ve added your domain, Unifiedesk generates a unique selector (usually default or mail) and embeds it into the TXT record. You just need to paste this into your DNS zone via your registrar—no guessing, no typo risks. This is true whether you’re using a free @unifiedesk.com address or setting up a custom domain for your business.

DKIM signing is active by default for all outbound mail. This means every message sent through Unifiedesk is cryptographically signed, helping prevent spoofing and making it harder for spam filters to block legitimate emails. The process follows RFC 6376 and is consistent with widely adopted practices across platforms like Google Workspace and Microsoft 365.

For those who want full control, the self-hosted option gives you the same workflow—just on your own infrastructure. You still get automatic key pair generation and DNS record output. It’s not about complexity; it’s about removing friction while maintaining security.

And yes, this works the same whether you're using Unifiedesk for email, calendar, video meetings, or shared documents. The email infrastructure is unified, and DKIM is part of that foundation.

When you look at how major email providers handle DNS records, the underlying mechanisms are similar. The difference? Unifiedesk makes it instant and foolproof—no need to learn opendkim syntax or debug failed signature checks. The system handles the hard part so you don’t have to.

SPF, DKIM, and DMARC: The Triad of Email Authentication

You generate a DKIM key pair by creating a public-private key set with a tool like OpenSSL, then publishing the public key as a DNS TXT record for your domain. This lets receivers verify your emails haven’t been tampered with during transit. Together with SPF and DMARC, DKIM forms the core email authentication stack that prevents spoofing and improves inbox delivery.

SPF: Authorizing Sending Servers

SPF tells email receivers which servers are allowed to send mail for your domain. You set it via a DNS TXT record listing IP addresses or service providers (like Gmail or your email host). If a server sends mail from your domain without being in the SPF list, the receiver may flag it as suspicious.

For example, if only your email provider’s servers are allowed to send mail, SPF prevents attackers from impersonating your domain using a random mail server. It doesn’t prevent content changes—just sender validation.

DKIM: Proving Email Integrity

DKIM adds a digital signature to each outgoing email using your private key. Receiving servers validate this signature using the public key published in your domain’s DNS. If the signature doesn’t match, the email was altered in transit or forged.

Let’s say you send a message: your mail server signs it with your private key. The recipient’s server fetches the public key from your DNS and verifies the signature. If it checks out, the email is intact. If not, it fails authentication.

DKIM doesn’t guarantee the sender is real—just that the content hasn’t changed. It’s a key part of anti-spoofing and trusted email flow. RFC 6376 defines the standard.

DMARC: Enforcing Policy

DMARC tells receivers what to do when SPF or DKIM checks fail. You publish a DMARC policy in DNS (typically as a TXT record), specifying actions like "none" (just report), "quarantine" (mark as suspicious), or "reject" (block outright).

You can use DMARC to monitor unauthorized emails without breaking sending immediately. Start with policy=none and gradually tighten to policy=reject after checking reports. This protects your domain from phishing and spoofing at scale.

Think of DMARC as the enforcement layer. SPF and DKIM do the work. DMARC says, "Now, act on it." This triad collectively prevents spoofed emails from reaching inboxes.

When you set up email with Unifiedesk, we generate and manage DKIM keys for you—automatically signing and verifying your mail. You get full control over your domain, with all core authentication records set up in minutes. Set up your custom domain with SPF, DKIM, and DMARC built in.

How to Verify Your DKIM Record Is Working Properly

After publishing your DKIM public key in DNS, test it directly: query the TXT record at default._domainkey.yourdomain.com using a free tool like MxToolbox or DNSchecker.org. Then send a test email to Gmail or Outlook, open the message source, and look for a DKIM-Signature: header. If it’s present and the public key matches exactly, your DKIM setup is working as intended.

Step-by-step verification process

  1. Check your DNS record with a public lookup tool. Use MxToolbox or DNSchecker.org to query the TXT record at default._domainkey.yourdomain.com. This ensures the record was published correctly and is visible to the internet.
  2. Verify the full public key matches exactly. The returned TXT value must include the full p= value, with no truncation, encoding errors, or missing spaces. DKIM requires exact string matching — even one extra space breaks verification.
  3. Send a test email from your domain. Use a tool like DKIM-signature standard to ensure the message is signed during delivery. Send it to a non-internal address — Gmail or Outlook work best for visibility.
  4. Inspect the full message source. In Gmail, click the three-dot menu on a received email and select "Show original." In Outlook, go to File → Properties → Internet Headers. Look for the DKIM-Signature: header. If it’s missing, the signature wasn’t applied.
  5. Confirm the signature is valid. A valid DKIM-Signature: header includes a d= field matching your domain, a q= algorithm (usually dns/txt), and a b= signature block. You don’t need to validate it manually — email providers do that automatically.

Common issues and how to fix them

Even small mistakes break DKIM. A trailing space in the TXT record, incorrect domain name, or missing p= tag will cause the signature to fail. Use the tools above to catch these before sending mail to clients.

If your test email still fails, check your email server’s DKIM signing configuration. It must sign every outbound message and include the full key as published. For teams using secure email platforms like Unifiedesk, this is handled automatically during setup — just ensure the DNS record was copied precisely.

Common DKIM Troubleshooting Steps

If your email fails DKIM validation, start by checking the DNS TXT record for typos, missing characters, or incorrect formatting—especially quotes or line breaks. A single misplaced character can break the signature. Use tools like MXToolbox or RFC 6376 to verify the record’s syntax. Also confirm your mail server is signing messages with the correct selector and that only one DKIM record exists per selector to avoid conflicts.

Check DNS Record Accuracy

  • Copy the full TXT record exactly as issued—no added quotes, spaces, or line breaks. Many DNS interfaces auto-wrap text; ensure the full value is preserved in a single line.
  • Use a public DNS lookup tool like MXToolbox’s DNS Lookup to verify the record is published correctly and matches the one you configured.
  • If you’re using a domain registrar with a GUI, double-check that you haven’t accidentally added a second DKIM record for the same selector.

Verify Key and Server Configuration

  • If you used opendkim-genkey, confirm the private key (kept securely) matches the public key published in DNS. The selector should be unique per signing key.
  • Ensure your mail server (Postfix, Exim, etc.) is configured to sign outgoing messages using the exact selector and domain from your DNS record.
  • Check logs on your mail server to confirm signing is enabled and messages are being processed with the right key. Misconfigurations here often result in "no signature found" errors.
  • For self-hosted setups, test signing with known tools like DKIM Tester to validate the key pair’s integrity.

Let’s be clear: DKIM isn’t an optional luxury—it’s essential for deliverability. A single misconfigured record can mean your emails end up in spam folders or get rejected entirely. If you're managing your own domain, consider using a hosted platform like Unifiedesk, which automates DNS record generation for DKIM, SPF, and DMARC—live in minutes—and includes built-in mail signing and encryption.

Why Self-Hosting DKIM Requires Care, But Gives Control

When you self-host DKIM, you generate and manage your own key pair—no third party does it for you. This means you control exactly when keys are created, stored, rotated, and revoked. You’re not trusting a provider’s defaults; you’re enforcing your own security policies. But it also means you’re responsible for keeping those keys secure and correctly configured across your DNS and mail servers. One misstep can break email authentication and hurt deliverability.

Full Control, Full Responsibility

You decide when to rotate keys, how long they stay valid, and where they’re stored. Unlike hosted services that handle this behind the scenes, self-hosting forces you to stay on top of key lifecycle management. A forgotten or exposed key can lead to spoofing, even if your domain is otherwise secure. According to RFC 6376, DKIM signing must be carefully managed to prevent abuse—so treating keys like sensitive assets isn’t optional.

But that responsibility is also power. You never hand over your keys to a cloud provider. They stay in your control, encrypted at rest with AES-256-GCM under per-account keys in Unifiedesk’s self-hosted deployment. This means even if someone gains access to your storage, they can’t read your keys without the account-specific decryption key.

Security in Transit and at Rest

TLS encrypts all communication in transit—between your mail client and server, and between your server and other mail providers. This protects your mail from eavesdropping during delivery. While DKIM itself signs the message headers and body, TLS ensures the entire channel is secure. This layered approach is standard best practice, as outlined in RFC 5246 (TLS 1.2).

With Unifiedesk, you retain control over your domain’s authentication setup while benefiting from strong encryption both in transit and at rest. You can generate a DKIM key pair using standard tools like OpenSSL, then configure the DNS TXT record manually. The process is straightforward—yet each step demands accuracy. A typo in the selector or the key value breaks validation.

For an efficient, secure setup, use the self-hosted Unifiedesk deployment to keep your mail, calendar, drive, and contacts under your control. Every message and file is encrypted with per-account keys, and your DKIM keys remain within your trusted infrastructure. No shared secrets. No dependency on third-party providers. You own the whole stack—from DNS record to mailbox.

You Can Generate a DKIM Key Pair—But Only If You Own the Domain

DNS records like DKIM are tied to your domain, not your email provider. You can’t set up DKIM unless you control the domain’s DNS configuration.

If you use a third-party email service with a custom domain, you still manage DKIM records — they don’t get applied automatically. Without proper setup, your emails may be marked as spam or fail to authenticate.

Unifiedesk simplifies the process

  • Enter your domain and we generate DKIM, SPF, and DMARC records automatically.
  • These records are validated in real time, no guesswork.
  • No manual DNS editing required — everything works live within minutes.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

What is the purpose of a DKIM key pair?

A DKIM key pair consists of a private key used to sign outgoing emails and a public key published in DNS. It verifies email authenticity and integrity.

Can I generate a DKIM key pair without command-line tools?

Yes—in tools like Unifiedesk, the key pair is generated automatically when you add a custom domain, requiring only DNS entry.

How do I find my DKIM selector?

The selector is the name part before `_domainkey`, like `default` in `default._domainkey.yourdomain.com`. It’s set during key generation.

Does every email server need a DKIM key?

No—only servers that send mail from a custom domain need DKIM to validate authenticity and prevent spoofing.

What happens if a DKIM record is missing?

Emails may be flagged as spam or rejected by receiving servers, harming deliverability and sender reputation.

Can I use the same DKIM key for multiple domains?

No—each domain must have its own DKIM key pair, as the public key is published under that domain’s DNS.

How often should I rotate DKIM keys?

Best practice is to rotate DKIM keys every 1–2 years. Unifiedesk supports key rotation via admin controls.

Is DKIM required for email deliverability?

It’s not legally required, but highly recommended—major providers use DKIM to verify sender identity and reduce spam.

Does Unifiedesk generate DKIM keys for free users?

Yes—free @unifiedesk.com users can add custom domains and receive automatically generated DKIM records.

Can I use my existing DKIM key with Unifiedesk?

Yes, if you’re migrating an existing domain, you can import your current DKIM public key into Unifiedesk’s DNS configuration.