---
title: "DKIM: definition, record format and example"
url: "https://coldmeetings.com/glossary/dkim.md"
canonical_url: "https://coldmeetings.com/glossary/dkim"
last_updated: "2026-10-19"
type: "conceptual"
summary: "DKIM adds a digital signature to each message, checked against a public key in your DNS. See how the selector and record fit together."
related: ["https://coldmeetings.com/glossary/spf.md", "https://coldmeetings.com/glossary/dmarc.md", "https://coldmeetings.com/glossary/sender-reputation.md"]
---

# DKIM: definition, record format and example

> **For AI agents:** the complete index of ColdMeetings pages is [llms.txt](https://coldmeetings.com/llms.txt). Every page is also served as markdown at its URL plus .md.

DKIM adds a digital signature to each message, checked against a public key in your DNS. See how the selector and record fit together.

**What is DKIM?**

DKIM, short for DomainKeys Identified Mail, signs each outgoing message with a private key held by the sender. The matching public key sits in your DNS, so a receiver can confirm the message came from your domain and was not changed on the way.

Group: 4. Deliverability.

## The parts

1. **A signature travels with the message**: The sending system adds a DKIM-Signature header. It names the signing domain and the selector used to find the key.
2. **The selector finds the key**: Selectors let one domain hold several keys at once. The public key is published as a TXT record at selector._domainkey.yourdomain.
3. **The mailbox host issues the key**: The service that sends your mail generates the key pair and gives you the public half to publish. The private half never leaves the sender.
4. **It supports DMARC**: DMARC passes when SPF or DKIM passes and the domain in the visible From address lines up with the domain that was checked.

## The DKIM record for cobaltway-mail.example

Cobaltway Analytics is invented. Its mailbox host issued a key under the selector google, and the company publishes it as a TXT record.

1. The host gives Cobaltway a selector (google) and a public key value.
2. Cobaltway publishes a TXT record at google._domainkey.cobaltway-mail.example.
3. Each message sent from the domain now carries a signature that receivers check against that record.
4. ColdMeetings lists the record in required_records once you pass dkim_value to POST /v1/domains, because the mailbox host issues the key.

DNS record to publish for DKIM. The key value is shortened here.

| Field | Value | Note |
| --- | --- | --- |
| Type | TXT | DKIM keys are published as text records. |
| Name | google._domainkey.cobaltway-mail.example | Selector, then _domainkey, then your domain. |
| Content | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... | Version, key type, then the public key. |

## How to apply it

1. Add the sending domain at your mailbox host and generate its DKIM key there.
2. Publish the key as a TXT record at the selector name the host shows you.
3. Pass the value to ColdMeetings, or publish it yourself, then run the domain check until dkim reports true.
4. Rotate to a new selector when a key is replaced, and keep the old record until mail signed with it has aged out.

## Common mistakes

- Publishing the record under the wrong selector name, so receivers never find the key.
- Pasting a key with a line break or a missing character from a copy.
- Enabling signing at the host before the DNS record is live.

## Related terms

- [SPF](https://coldmeetings.com/glossary/spf.md): SPF, short for Sender Policy Framework, is a DNS TXT record on your domain that lists the servers allowed to send mail using that domain.
- [DMARC](https://coldmeetings.com/glossary/dmarc.md): A DMARC policy is a DNS record you publish for your domain.
- [Sender reputation](https://coldmeetings.com/glossary/sender-reputation.md): Sender reputation is the running record a mailbox provider keeps about a sending domain or address, built from how recipients and receiving systems treated its past mail.

## Keep reading

- [Domains and inboxes](https://coldmeetings.com/product/domains-and-inboxes.md)
- [Email deliverability guide](https://coldmeetings.com/blog/email-deliverability-guide.md)
- [Cold emails going to spam](https://coldmeetings.com/blog/cold-emails-going-to-spam.md)

## Questions

### What does the selector do?

It is a label that tells a receiver which key to fetch, so a domain can use several keys at once, for example one per sending service or one per year.

### Does DKIM encrypt my email?

No. DKIM signs a message so its origin and content can be checked. It does not hide the content.

### Do I need both SPF and DKIM?

Google and Yahoo ask bulk senders to set up both. ColdMeetings treats a domain as authenticated only when SPF, DKIM and DMARC all check out.

## Sources

- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures: https://www.rfc-editor.org/rfc/rfc6376, read 2026-10-19
- Google: Email sender guidelines: https://support.google.com/a/answer/81126, read 2026-10-19
- Yahoo: Sender best practices: https://senders.yahooinc.com/best-practices/, read 2026-10-19

Questions about outbound for your own company? Email hello@coldmeetings.com.

## Related

- [SPF: definition, record format and example](https://coldmeetings.com/glossary/spf.md)
- [DMARC: definition, record parts and rollout](https://coldmeetings.com/glossary/dmarc.md)
- [Sender reputation: what shapes it](https://coldmeetings.com/glossary/sender-reputation.md)