Why DKIM exists
SPF authenticates the sending IP. DKIM authenticates the message itself: it proves the body was not modified between sender and receiver, and that the signing party controls the private key matching the published public key.
Together SPF and DKIM provide the two halves DMARC uses to produce a single verdict. DKIM specifically defends against forwarders that rewrite the envelope sender (which breaks SPF) — the cryptographic signature survives the forward.
The selector and the public key
A DKIM-Signature header on every message references the selector that signed it. Receivers query DNS for <selector>._domainkey.<domain> to fetch the public key. The selector lets a single domain publish many keys at once (one per provider, one per environment, one per rotation).
sndr1._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq...AQAB"Key rotation and revocation
Best practice is to rotate DKIM keys periodically — every 6-12 months — and immediately on any suspicion of compromise. Old selectors stay in DNS but get marked revoked (empty p=) so receivers can verify archived mail without anyone signing fresh mail with the dead key.
Google rotates date-based selectors (20230601, 20221208) for its own domains and uses the literal google selector for Google Workspace tenants. Microsoft 365 uses selector1 and selector2, both CNAMEs to keys under the *.onmicrosoft.com tenant zone.
Key size
RSA-1024 is the spec floor; RSA-2048 is the modern recommendation. Some receivers (notably Gmail) downgrade or reject signatures below 1024 bits.
ED25519 keys are supported by the DKIM spec but rarely used in practice. Stick to RSA-2048 unless you have a specific reason to deviate.
How SNDR handles DKIM
When you verify a sending domain in SNDR, we generate a fresh RSA-2048 keypair, ship you the public-key TXT record to publish, and sign every outgoing message with the private half. Rotations are handled automatically — we publish the next selector well before retiring the previous one, so receivers verifying a 7-day-old message can still resolve the key.
The /tools/dkim-checker page parses any domain's DKIM record, estimates the key size, follows CNAME indirection (M365 / SendGrid pattern), and distinguishes a revoked selector (empty p=) from a misconfigured one.