DKIM Record Setup & Email Authentication Guide
Step-by-step guide to generating, publishing, and enabling DomainKeys Identified Mail (DKIM) signatures for Microsoft 365, Google Workspace, and cPanel mail servers to prevent tampering.
⚡ Direct Answer & Quick Diagnostic Summary (AEO)
To configure DKIM (DomainKeys Identified Mail) and guarantee cryptographic authenticity for corporate outbound email: Generate a public/private cryptographic key pair within your mail platform (Microsoft 365 Exchange Online, Google Workspace Admin, or cPanel Email Delivery) and publish the public key as a DNS CNAME or TXT record under a designated selector prefix (e.g. "selector._domainkey.yourdomain.pk"). For Microsoft 365, Microsoft utilizes dual CNAME records targeting "selector1-<domainGUID>._domainkey.<tenant>.onmicrosoft.com" and "selector2", providing seamless automated key rotation. For Google Workspace, generate a 2048-bit RSA TXT record under "google._domainkey" in Google Admin Console. For cPanel on local hosting in Pakistan, enable DKIM inside "Email Deliverability" to generate an on-host key pair. After publishing DNS records to Cloudflare, Route 53, or cPanel DNS, verify propagation using "dig TXT selector._domainkey.yourdomain.pk". Finally, return to your email management console and flip the DKIM signing switch to "Enabled". This attaches an encrypted DKIM-Signature header to every outgoing message, proving to recipient filters that message bodies and critical headers were not tampered with in transit.
Primary Root Causes
Can't resolve this issue or hardware failure halted your shift?
Our certified field hardware & network engineers are on standby for emergency on-site repair across Korangi, SITE, Clifton, DHA, Shahrah-e-Faisal, and all Karachi commercial areas.
Step-by-Step Diagnostic Checklist
Step 1: Choose Key Architecture & Generate DKIM Keys
In Microsoft 365 Defender / Exchange Admin Center (Security -> Policies -> Email authentication -> DKIM), select your domain and click "Create DKIM keys". In Google Workspace Admin, navigate to Apps -> Google Workspace -> Gmail -> Authenticate email and click "Generate New Record" using 2048-bit key length. In cPanel, navigate to Email Deliverability and click "Manage" next to your domain.
Step 2: Note Selector Names and DNS Record Types
Microsoft 365 issues two CNAME records (selector1 and selector2) pointing to Microsoft's managed key infrastructure. Google Workspace and cPanel issue a TXT record typically using the selector name "google" or "default" (e.g. google._domainkey.yourdomain.com.pk) containing "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
Step 3: Publish DKIM DNS Records in Authoritative DNS
Log into your DNS provider (Cloudflare, cPanel DNS Zone Editor, AWS Route 53, or domain registrar). For Microsoft 365, create two CNAME records: Name selector1._domainkey, Target selector1-yourdomain-com-pk._domainkey.tenant.onmicrosoft.com (disable Cloudflare orange-cloud proxy if on Cloudflare). For Google Workspace or cPanel, create a TXT record at host selector._domainkey containing the full public key string.
Step 4: Handle 2048-bit Key String Splitting for Legacy DNS
Some older cPanel or Pakistani web host DNS panels limit TXT values to 255 characters. A 2048-bit RSA public key is ~450 characters. In BIND/RFC 4408 compliant DNS, split the key into two adjacent quoted strings inside parentheses: ("v=DKIM1; k=rsa; p=FIRST_HALF" "SECOND_HALF"). Modern DNS providers like Cloudflare handle this automatically.
Step 5: Verify DNS Resolution with DIG / NSLookup
Before enabling signing, confirm that public DNS resolvers can return your public key. Open terminal and run: nslookup -type=TXT selector._domainkey.yourdomain.pk 8.8.8.8. If the record resolves cleanly with the "p=" cryptographic key parameter, DNS propagation is successful.
Step 6: Enable DKIM Signing in Mail Administration
Return to Microsoft 365 EAC or Google Workspace Admin. Toggle the "Sign messages for this domain with DKIM signatures" switch to "Active" (or click "Start Authentication"). Send a test email to check-auth@verifier.port25.com or an external Gmail address. Inspect the headers to confirm "dkim=pass (ok)" is verified.
Frequently Asked Questions
Why does Microsoft 365 require two DKIM CNAME records?
Microsoft 365 implements automated cryptographic key rotation to comply with enterprise security standards. Having two selectors (selector1 and selector2) allows Microsoft to rotate the active private key and publish the new public key without downtime or verification failure while in-flight emails are being delivered.
Should I use 1024-bit or 2048-bit DKIM keys?
Always use 2048-bit RSA keys for modern email security. 1024-bit keys are considered cryptographically weak and deprecated by major providers (Google, Yahoo, Microsoft). Only fall back to 1024-bit if your DNS hosting provider has an unfixable 255-character TXT string limit that does not support multi-string concatenation.
Does DKIM replace SPF?
No. SPF validates the sending server IP address against the envelope sender (Return-Path), while DKIM cryptographically signs the email headers and body to prove the message was not modified in transit. Both SPF and DKIM are independent pillars that feed directly into DMARC alignment.
Need Enterprise Deployment or Support for IT Support & IT Services?
If your team needs full hands-on setup, SLA monitoring, or emergency on-site assistance in Karachi, our certified engineers are ready.