Question 1

What is DKIM?

Accepted Answer

DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was sent by the domain it claims to be from and hasn't been altered in transit.

Question 2

What is a DKIM selector?

Accepted Answer

A DKIM selector is a string used to locate the DKIM public key in DNS. The full lookup is selector._domainkey.domain. Common selectors include 'default', 'google', 'selector1', 'k1', etc. Each email service provider uses its own selectors.

Question 3

What key size should DKIM use?

Accepted Answer

DKIM keys should be at least 2048 bits for security. 1024-bit keys are still functional but considered weak. Keys shorter than 1024 bits should be replaced immediately.

Question 4

How do I find my DKIM selector?

Accepted Answer

Check the DKIM-Signature header in any email sent from your domain. Look for the 's=' tag - that's your selector. Common values: 'google' (Google Workspace), 'selector1'/'selector2' (Microsoft 365), 'k1' (Mailchimp), 'mail' (generic).

Question 5

What does a CNAME in DKIM mean?

Accepted Answer

Many email service providers (Brevo, Mailchimp, SendGrid) use CNAME records to point your DKIM selector to their own DNS. This is normal and allows the ESP to manage DKIM key rotation automatically.