--- title: "A guide to DKIM syntax, create your DKIM record for free | DuoCircle" description: "A guide to DKIM syntax, create your DKIM record for free." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/" --- Quick Answer A DKIM record is a DNS TXT record that publishes a public key receiving servers use to verify the DKIM signature on inbound messages. The standard tags are: v= (version, always v=1), a= (algorithm, typically rsa-sha256), d= (signing domain), s= (selector identifying which key to use), h= (signed headers), bh= (body hash), b= (the actual signature data), and c= (canonicalization, simple or relaxed). Optional tags include q= (query method), t= (timestamp), x= (expiration), l= (body length), and z= (copied headers for diagnostics). DKIM breaks on forwarded mail and mailing lists when intermediaries modify content or headers; ARC (Authenticated Received Chain) preserves authentication results across hops to mitigate this. Generate records with a DKIM tool rather than hand-rolling them, then verify with a DKIM lookup before relying on the record. A guide to DKIM syntax, create your DKIM record for free Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/07/A-Guide-To-DKIM-Syntax–-Create-Your-DKIM-Record-For-Free.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fdkim-syntax-guide-create-your-dkim-record-for-free%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=A%20guide%20to%20DKIM%20syntax%2C%20create%20your%20DKIM%20record%20for%20free&url=undefined%2Fblog%2Femail-security%2Fdkim-syntax-guide-create-your-dkim-record-for-free%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fdkim-syntax-guide-create-your-dkim-record-for-free%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fdkim-syntax-guide-create-your-dkim-record-for-free%2F&title=A%20guide%20to%20DKIM%20syntax%2C%20create%20your%20DKIM%20record%20for%20free "Share on Reddit") [ ](mailto:?subject=A%20guide%20to%20DKIM%20syntax%2C%20create%20your%20DKIM%20record%20for%20free&body=Check out this article: undefined%2Fblog%2Femail-security%2Fdkim-syntax-guide-create-your-dkim-record-for-free%2F "Share via Email") ![DKIM Syntax](https://media.mailhop.org/duocircle/images/2024/07/what-is-dkim-1.jpg) A [DKIM](/resources/what-is-dkim) record is a DNS record in the **TXT format** that includes a public key that is used by recipients’ mail servers to verify the legitimacy of emails they receive from your domain. A standard DKIM record has a **name, version, key type, and public key**. Some domain owners think that creating a DKIM record requires hardcore technical expertise, but that’s not true, especially when it comes to generating a basic [DKIM record](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/). You just need to be an average tech user, and you will be able to create a DKIM record on your own. ## The purpose of DKIM DKIM is a technology that verifies whether an email was sent from a mail server **officially authorized** by the domain owner. It is based on the concept of [public key cryptography](https://en.wikipedia.org/wiki/Public-key%5Fcryptography), which is the same standard as used in [SSL certificates](https://www.digicert.com/what-is-an-ssl-certificate). When you deploy DKIM for your domain, the sender’s mail server **digitally signs** a part of the outgoing email. Then, upon reception, the receiving mail server retrieves the public key from your DKIM record to verify the signature. _A successful verification indicates that the email content was not modified in transit, which means the recipient has received the email exactly how it was sent by you._ This technology prevents recipients from [deceiving messages](https://www.mirror.co.uk/news/uk-news/amazon-prime-members-targeted-new-33159426). ### The concept of cryptographic keys _In DKIM, there are **two cryptographic keys** involved per DKIM record._ One is a [private key](https://www.techtarget.com/searchsecurity/definition/private-key) that nobody knows or has access to except the owner. The second is the **public key that is openly available**. Both keys are related to each other, which means that the text encrypted with the private key will be decrypted with its corresponding public key only and vice versa. _In simpler words, if a receiving server is able to decrypt a message with the public key mentioned in the sending domain’s DKIM record, then **there is a surety** that it was signed with the private key that only the owner of the sender’s domain knows._ In simpler words, if a receiving server can decrypt a message using the public key specified in the sending domain’s DKIM record, it confirms the message was signed with the private key known only to the domain owner. Properly [adding DKIM record](https://cyberpanel.net/blog/how-to-setup-dkim) ensures this authentication process works reliably and boosts email deliverability. If you enable DKIM, then the [digital signature](/email-security/fixing-your-dkim-signature-is-not-valid-error/) will be added to the **header of all emails** sent from your domain. The recipient’s server can read in the header which part of the email it needs to verify and the location of the public key that it will require for verification. ## DKIM encounters issues with forwarded emails and mailing lists DKIM faces problems with [email forwarding](/email/email-forwarding) and mailing lists because the email content and headers get modified. So, when an email is forwarded, the DKIM **signature no longer matches** the original email, triggering DKIM to fail. The same is true for [mailing lists](https://www.one.com/en/email/what-is-a-mailing-list). Mailing lists often modify the original email by adding headers, footers, or making other alterations. These changes can **invalidate the DKIM** signature. Additionally, mailing lists may modify the subject line, add list-specific headers, or even strip certain headers, which can affect [DKIM validation](/resources/dkim-validation). ### How to mitigate this problem? There are 4 main strategies that you can deploy to minimize or evade the [shortfalls of DKIM](https://www.palisade.email/resources-post/top-10-reasons-why-dkim-fails-understanding-and-fixing-email-authentication-issues) with forwarded emails and mailing lists. #### Enable ARC [ARC](https://en.wikipedia.org/wiki/Authenticated%5FReceived%5FChain) is a relatively new [email security](/) technology that preserves email authentication results **across intermediate servers** that emails pass through when forwarded or sent using mailing lists. It allows intermediaries to record the authentication status of the message exactly as they received it, enabling downstream systems to trust the results even if the message is modified. #### Use the “l=” tag _The job of the [“l=tag”](https://dmarcreport.com/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/)_ _is to specify the length of the message body that is included in the signature._ This can be useful if only the initial part of the message body is signed, **allowing certain types of modifications** to not break the signature. Please note that this tag has some limitations. #### Minimize changes Encourage mailing lists and [email forwarding services](/content/email-forwarding-services/best-free-email-forwarding-service) to minimize changes in the original email content sent by you. There are some software that allow you to make configurations so that they make **minimal modifications** to the messages they process. #### Sender rewriting scheme For forwarded emails, [SRS](https://world.siteground.com/blog/introducing-sender-rewrite-scheme/) can help maintain [SPF](/content/spf-record-check) validity, but it does not directly address DKIM. _Combining SRS with ARC can provide a more comprehensive solution_. [![Sender Rewriting Scheme](https://media.mailhop.org/duocircle/images/2024/07/DMARC-reporting-service-2.jpg)](https://media.mailhop.org/duocircle/images/2024/07/DMARC-reporting-service-2.jpg) ## DKIM Syntax Here’s a breakdown of the **most used** DKIM syntax elements- ### ‘v’ tag (mandatory) It stands for the ‘version’ tag that basically indicates the **DKIM version** you use. Currently, there is only one version, so it is always ‘v=1.’ ### ‘a’ tag (mandatory) It stands for the ‘algorithm’ tag and specifies the **algorithm used to generate a signature**. [Common algorithms](https://www.ibm.com/docs/en/zos/2.5.0?topic=support-signature-hash-algorithms) are rsa-sha256 and rsa-sha1. ### ‘d’ tag (mandatory) It stands for the ‘**domain’ tag** and indicates the domain that is claiming responsibility for the message. ### ‘s’ tag (mandatory) It stands for the ‘selector’ tag that specifies the [DKIM selector](/resources/what-is-dkim-selector) used to **locate the public key** in DNS. ### ‘c’ tag (optional) It stands for the ‘canonicalization’ tag and tells the [canonicalization](https://en.wikipedia.org/wiki/Canonicalization) algorithms for the header and body. Two types are allowed: **simple and relaxed**. ### ‘q’ tag (optional) It stands for the ‘query method’ tag and defines the **method used to retrieve the public key**. Typically, this is dns/txt. ### ‘t’ tag (optional) It stands for the ‘**timestamp’ tag** and provides the [signature timestamp](https://www.advancedinstaller.com/digital-signature-timestamp.html) in Unix time format. ### ‘x’ tag (optional) It stands for the ‘expiry’ tag and specifies the **expiration time** for the signature in [Unix time format](https://en.wikipedia.org/wiki/Unix%5Ftime#:~:text=Unix%20time%20is%20a%20date,such%20as%20microseconds%20or%20nanoseconds.). ### ‘h’ tag (mandatory) _It stands for the ‘signed headers’ tag and lists the headers that are included in the signing process_. Common headers include **From, To, Subject**, etc. ### ‘bh’ tag (mandatory) It stands for the ‘**body hash’ tag** and contains the hash of the canonicalized body part of the message. ### ‘b’ tag (mandatory) It stands for the ‘signature data’ tag and holds the **actual digital signature**, which is usually a [base64 encoded string](https://builtin.com/software-engineering-perspectives/base64-encoding). ### ‘l’ tag (optional) It stands for the ‘body length count’ tag and species the **length of the canonicalized body** that has been signed. ### ‘z’ tag (optional) It stands for the ‘copied headers’ tag and provides a list of [header](/email-services/learning-to-trace-back-emails-to-their-source-ip-addresses/) fields copied from the email and their values, which can be **used for diagnostic purposes**. ## Final words _Avoid creating a DKIM record manually, as this approach is more prone to human errors._ Instead, use one of the online [DKIM generator](/resources/dkim-generator) tools. Once your DKIM record is produced, update it on your domain’s DNS and regularly run it through one of the **DKIM lookup tools** to see if there are any errors in it. If detected, fix the errors without any delays to prevent [threat actors](https://thehackernews.com/2024/07/microsoft-mshtml-flaw-exploited-to.html) from exploiting your [vulnerable DKIM record](https://securityboulevard.com/2024/06/l-tag-dkim-vulnerability-what-can-you-do-to-secure-your-email/). For any help, [contact us](/contact). ## Topics email securityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Email Security 7m 10 Crucial Tips that Will Help You Avoid Spam Filters and Send Better Emails Feb 14, 2023 ](/blog/email-security/10-crucial-tips-that-will-help-you-avoid-spam-filters-and-send-better-emails/)[ Email Security 6m 5 Reasons Why Your Website Needs an SPF Record Flattener? Sep 26, 2023 ](/blog/email-security/5-reasons-why-your-website-needs-an-spf-record-flattener/)[ Email Security 8m Best Practices to Follow When Implementing SPF, DKIM, and DMARC Mar 19, 2024 ](/blog/email-security/best-practices-to-follow-when-implementing-spf-dkim-and-dmarc/)[ Email Security 3m Best Ways to Secure Emails in 2024 Apr 26, 2024 ](/blog/email-security/best-ways-to-secure-emails-in-2024/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"A guide to DKIM syntax, create your DKIM record for free","description":"A guide to DKIM syntax, create your DKIM record for free.","url":"https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/","datePublished":"2024-07-05T16:24:03.000Z","dateModified":"2025-05-19T13:09:07.000Z","dateCreated":"2024-07-05T16:24:03.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/"},"articleSection":"email-security","keywords":"email security, Updates","wordCount":1158,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/07/what-is-dkim-1.jpg","caption":"DKIM Syntax","width":900,"height":535},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"A guide to DKIM syntax, create your DKIM record for free","item":"https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"A guide to DKIM syntax, create your DKIM record for free","item":"https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"A guide to DKIM syntax, create your DKIM record for free","description":"A guide to DKIM syntax, create your DKIM record for free.","url":"https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/","datePublished":"2024-07-05T16:24:03.000Z","dateModified":"2025-05-19T13:09:07.000Z","dateCreated":"2024-07-05T16:24:03.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/dkim-syntax-guide-create-your-dkim-record-for-free/"},"articleSection":"email-security","keywords":"email security, Updates","wordCount":1158,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/07/what-is-dkim-1.jpg","caption":"DKIM Syntax","width":900,"height":535},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```