How to Create a DKIM Record

If you've ever wondered why some emails land in spam folders while others sail straight into the inbox, email authentication is a big part of the answer. DKIM is one of the most important pieces of that puzzle—and it's something every business owner sending email from a custom domain should have set up.

The good news: you don't need a technical background to understand what DKIM is, why it matters, or how to get it working. This guide walks you through everything clearly, step by step.

Get Your Custom Domain

What Is DKIM?

DKIM stands for DomainKeys Identified Mail. It's an email authentication protocol that lets you attach a verifiable digital signature to every email you send. That signature tells receiving mail servers—like Gmail or Outlook—that your message genuinely came from your domain and hasn't been tampered with in transit.

What the "Key" in DomainKeys Identified Mail means

The word "key" in DomainKeys is literal. DKIM works using a pair of cryptographic keys:

• A private key that lives on your email sending server and signs each outgoing message

• A public key that you publish in your domain's DNS records, where receiving servers can find and read it

When someone receives an email from you, their mail server looks up your public key in your DNS records and uses it to verify the signature attached to your message. If the signature matches, the email passes DKIM authentication. If it doesn't match—or if there's no signature at all—the message is treated with suspicion.

Think of it like a wax seal on an envelope. The seal proves the letter came from you and hasn't been opened or altered. The public key in your DNS is how recipients verify that seal is genuine.

Why DKIM matters

It protects your domain's reputation

Without DKIM, it's easier for bad actors to send email that appears to come from your domain. This is called email spoofing, and it's a common tactic in phishing attacks. DKIM makes it significantly harder to impersonate your brand, which protects your customers and your reputation at the same time.

It improves email deliverability

Major email providers use DKIM as one of several signals to determine whether an incoming message is trustworthy. A properly authenticated email is more likely to reach the inbox. An email without proper authentication—or with a failed DKIM check—is more likely to be filtered into spam or blocked entirely.

If you're sending newsletters, client proposals, invoices, or any other important emails from your custom domain, DKIM is a meaningful factor in whether those messages actually get read.

It works alongside other authentication standards

DKIM doesn't work alone. It's part of a broader email authentication framework that also includes:

• SPF (Sender Policy Framework): Specifies which servers are authorized to send email on behalf of your domain

• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do when a message fails SPF or DKIM checks

Together, these three standards form a strong foundation for email security and deliverability. DKIM is a critical part of that foundation, and setting it up is one of the most impactful things you can do for your domain's email health.

How to create a DKIM record

Here's a practical overview of the process. The exact steps vary depending on your email provider and DNS host, but the structure is consistent across most platforms.

Step 1: Generate your DKIM keys

DKIM keys are generated by your email sending service—not by you manually. If you use Google Workspace, Microsoft 365, or another email platform, they'll generate the private and public key pair for you. You typically find this option in your email platform's security or authentication settings.

Look for a section labeled "DKIM," "Email Authentication," or "Domain Authentication" in your email provider's admin panel. Once you generate the keys, your provider will give you a public key value to copy—along with a "selector," which is a short label that helps identify which key is being used.

Step 2: Copy your DKIM public key

Your email provider will display a DKIM public key as a long string of characters. It'll look something like this:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...

Copy this value exactly. You'll paste it into your DNS settings in the next step.

Step 3: Add the DKIM record to your DNS settings

Log in to wherever your domain's DNS is managed. For most people, this is your domain registrar—like Squarespace Domains. Look for a section called "DNS Settings," "DNS Management," or "Advanced DNS."

You'll add a new DNS record with the following structure:

• Record type: TXT

• Host/Name: This is your DKIM selector followed by ._domainkey. For example, if your selector is google, the host value would be google._domainkey

• Value: Paste in the full DKIM public key string your email provider gave you

• TTL (Time to Live): Set this to the default or recommended value—usually 3,600 seconds (one hour)

Save the record. Changes to DNS records typically take anywhere from a few minutes to 48 hours to fully propagate, though most updates resolve within a few hours.

Step 4: Enable DKIM signing in your email platform

Once the DNS record is in place, return to your email provider's authentication settings and enable DKIM signing. Your provider will often include a "Verify" or "Check" button that confirms your DNS record is live and correctly formatted before activating.

If the verification passes, DKIM signing is active and your outgoing messages will carry your domain's cryptographic signature going forward.

Step 5: Confirm everything is working

You can verify your DKIM setup using free tools like MXToolbox or Google's Admin Toolbox. Enter your domain and selector, and these tools will check whether your public key is visible and correctly configured in DNS.

If the check passes, you're done. If something looks off, double-check that the record value was copied exactly and that the host name format matches what your email provider specified.

Common things to watch for

Copy the key value exactly. DKIM public keys are long and precise. Even a single extra space or missing character can cause authentication to fail. Most email providers let you copy the full value with one click—use that option when you can.

Use the right host name format. The selector and ._domainkey suffix need to be formatted correctly for your DNS provider. Some DNS hosts add your root domain automatically; others require you to include it manually. Check your registrar's documentation if you're unsure.

Don't delete or overwrite an existing DKIM record. If you've already added one and need to update it, check whether your DNS host allows multiple TXT records at the same subdomain. Some providers handle this differently.

Give DNS changes time to propagate. If your verification check fails immediately after adding the record, wait a few hours and try again before assuming something is wrong.

Setting up DKIM through Squarespace and Google Workspace

If you register your domain with Squarespace and use Google Workspace for business email, the DKIM setup process is significantly simplified. Squarespace automatically configures many of the DNS records required by Google Workspace—including those needed for email authentication—during the initial setup.

You'll still want to verify that DKIM signing is enabled within your Google Workspace Admin Console, but the most technically involved part of the process—publishing the correct DNS record—is handled for you.

This is one of the clearest advantages of managing your domain and email from the same platform. Fewer steps, less room for error, and a professional email setup that works the way it should from day one.

A quick reference: What each DKIM step does

• Generate keys: Create the private and public key pair in your email provider's admin panel.

• Copy the public key: Get the value you'll need to add to your DNS settings.

• Add a TXT record: Publish your public key online through your DNS host (e.g., Squarespace Domains).

• Enable DKIM signing: Activate the signature on outgoing mail from your email provider.

• Verify the setup: Confirm the record is live and correct using MXToolbox or your email provider's verification tool.

DKIM Is worth setting up

Email authentication isn't just for IT teams or large organizations. If you're running a business from a custom domain—sending client emails, marketing messages, or anything in between—DKIM is a straightforward way to protect your domain and improve the chances that your emails actually get read.

It's one of those behind-the-scenes details that most people never think about until something goes wrong. Getting it in place now, before you experience deliverability problems or a spoofing attempt, is a much better position to be in.

Your domain is the foundation of your email identity. Make sure it's properly authenticated—and if you're starting fresh, Squarespace gives you the tools to get there without the technical headache.