What DKIM does
DKIM is the wax seal on your email. Your mail service adds a digital signature to every message, and publishes the matching public key in your DNS. The receiving server checks the signature against the key: if it matches, the message really came from your service and wasn't altered.
The key sits under a selector, for example:
selector1._domainkey.yourdomain.co.za
Selectors we check
We look for keys at selector1 and selector2 (Microsoft 365), google (Google Workspace), k1 (Mailchimp), and the common defaults default, dkim and mail.
That covers most South African businesses, which send through Microsoft 365 or Google. If your mail goes through a hosting company's mail server, ask them which selector they sign with.
Why DKIM matters for DMARC
DMARC passes when either SPF or DKIM passes and matches your From domain. DKIM is the one that survives forwarding and mailing lists, so it's what keeps legitimate mail delivered once you move DMARC to quarantine or reject.
Common questions
Why does the checker say no DKIM was found when I set it up?
DKIM keys live under a selector name that only your mail service knows, and DNS has no way to list them. We try the selectors used by Microsoft 365, Google Workspace and the most common mail services. If yours uses a different name, the key can exist and still not be found. Check a recent email's headers for s= in the DKIM-Signature line to see your selector.
How do I turn on DKIM in Microsoft 365?
In the Microsoft Defender portal, open Email authentication settings, choose DKIM, select your domain and follow the prompt to publish the two CNAME records (selector1 and selector2) it shows you. Once they resolve, switch signing on.
How do I turn on DKIM in Google Workspace?
In the Google Admin console, go to Apps, Google Workspace, Gmail, Authenticate email. Generate a 2048-bit key, publish the TXT record at google._domainkey on your domain, then click Start authentication.
Does every service that sends my mail need its own DKIM?
Yes. Each sender (your mailbox provider, newsletter tool, invoicing system) signs with its own key under its own selector. Each one needs its record published on your domain.