---
title: "Sign every message with DKIM · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim
updated: 2026-10-20
licence: "All rights reserved"
---

# Sign every message with DKIM

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: Sign every message with DKIM, using a 2048-bit RSA key on your own domain, and replace each key at least every six months.
- How: DKIM (RFC 6376) signs the headers and body, so changes on the way break the signature. Ask each sending service to sign with your domain, not theirs. Publish the public key at `selector._domainkey.example.com`. A 2048-bit key is longer than one 255-character DNS string, so split it into several quoted strings in one record. Rotate with a new selector, as M3AAWG advises, and keep the old key published for a few days. Ed25519 keys (RFC 8463) can be added next to RSA, but not instead of it. Gmail accepts 1024 bits as a minimum, but recommends 2048.
- Check: `dig +short TXT s2026._domainkey.example.com` returns the key, and a key-length checker reports 2048 bits. A test message shows `dkim=pass` with `header.d=example.com`, or a subdomain of it. The selector in use is less than six months old.

Example:

```dns
s2026._domainkey.example.com.  3600  IN  TXT  ( "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
                                                  "...rest of the key...IDAQAB" )
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim`.

- Previous: [Publish an SPF record](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/spf)
- Next: [Enforce DMARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)