Setting up DKIM for your domain

Where DKIM keys come from, how to publish them, and what a selector actually is.

✉️ MailMedic4 min readUpdated 2026-08-22

Unlike SPF, you do not write a DKIM record yourself. The service that sends your mail generates a key pair and gives you the public half to publish. Your job is to put it in the right place.

What a selector is

A selector is a label that lets one domain hold several DKIM keys at once — one per sending service. It appears in the record name, like this:

google._domainkey.your-domain.com
shopify._domainkey.your-domain.com

That is why MailMedic reports DKIM per selector rather than as a single yes or no. One service can be signing correctly while another is not.

Publishing the record

  1. In your sending service (Shopify, Google Workspace, your marketing tool), find the DKIM or domain authentication section.
  2. Copy the record it gives you. It will be either a TXT record with a long key, or a CNAME pointing at the provider.
  3. Add it to your DNS exactly as given, including the selector part of the name.
  4. Return to the sending service and click its verify button.
Do not retype the key by hand. DKIM keys are long, and a single wrong character makes every signature invalid without any obvious symptom. Copy and paste.

Checking it worked

Re-run the MailMedic scan. A passing DKIM check means receivers can now verify your messages. If it still fails after an hour, the most common causes are a trailing space in the record value, or the provider not being told to start signing.

Did this answer your question?

If anything here was wrong, unclear or out of date, tell us — the article gets fixed the same day.

Something is missingBack to help centre

Related articles