Sending domain and authentication Required

Sign every message with DKIM

Sign every message with DKIM, using at least a 2048-bit RSA key on your own domain, and replace keys on a schedule.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

DKIM (RFC 6376) signs the headers and body, so changes on the way break the signature. Ask each sending service to sign with your domain, not theirs. Publish the public key at selector._domainkey.example.com. Rotate keys at least once a year with a new selector, and keep the old key published until mail signed with it has been delivered. Ed25519 keys (RFC 8463) can be added next to RSA, but not instead of it.

Example

s2026._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

How to check

dig +short TXT s2026._domainkey.example.com returns the key. A test message shows dkim=pass with header.d=example.com, or a subdomain of it.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim.