How to set up DKIM signing
DKIM (DomainKeys Identified Mail) cryptographically signs each outbound email so the receiver can verify it wasn't tampered with and that your domain authorised it. Without DKIM, the 2024 bulk-sender rules from Google/Yahoo/Microsoft will downgrade your deliverability.
Setup is typically 5-15 minutes per sending service. Each sender (Google Workspace, your transactional ESP, your cold-outbound tool) needs its own DKIM key published in your DNS.
Before you start
- Domain you control (must have DNS edit access)
- Admin access to each sending service (Google Workspace admin, ESP admin, etc.)
Step-by-step
- 1
Pick a selector name per sending service
Selectors are arbitrary labels that identify which DKIM key to use. Convention: google, microsoft, mailgun, sendgrid, outreach. Each service uses a different selector so you can have multiple DKIM keys on the same domain.
- 2
Generate the DKIM key pair in the sending service
In Google Workspace admin: Apps → Google Workspace → Gmail → Authenticate email. In ESPs: Settings → Sending Domain → Generate DKIM. Use 2048-bit keys (1024-bit is now considered weak).
- 3
Copy the public key from the sending service
The service displays the DKIM public key and the DNS record format. Typical format: selector._domainkey.yourdomain.com TXT 'v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE'
- 4
Publish the DNS TXT record
In your DNS provider dashboard, create a TXT record at selector._domainkey.yourdomain.com with the value from step 3. TTL 3600 is fine.
- 5
Activate DKIM signing in the sending service
After DNS publishes (5-15 minutes), go back to the sending service and click 'Start Authentication' or 'Activate DKIM'. The service queries DNS to verify the key is published, then enables signing on outbound mail.
- 6
Send a test and verify in headers
Send to a mailbox you control. Open raw headers. Look for Authentication-Results: dkim=pass and a DKIM-Signature header with d=yourdomain.com. Pass means working.
Set up tracking in 2 minutes instead of 20.
Outsolvi installs as a native Outlook add-in or Gmail Chrome extension. Confidence-scored opens, AI follow-up alerts, native Outlook and Gmail tracking. From $7/mo, 14-day free trial.
Troubleshooting
DNS lookup shows the record but DKIM verification fails
Wait 15-60 minutes for full DNS propagation. If still failing, the public key in the DNS record may be malformed (line breaks, extra spaces). Re-copy from the sending service exactly.
DKIM passes but DMARC fails
Alignment issue: the DKIM-signing domain doesn't match the visible From domain. The d= tag in the DKIM signature must match the From-header domain for DMARC alignment.
Body modification breaks DKIM after some hops
Mailing-list footers, antivirus banners, and some forwarding services modify the email body, which invalidates the signature. ARC (Authenticated Received Chain) is the workaround but isn't universally supported.
Frequently asked
How often should I rotate DKIM keys?
Industry standard is annually. Generate a new selector + key, publish both, switch sending to the new selector, then remove the old selector after a few weeks.
Can I have multiple DKIM signatures on one email?
Yes. Multiple DKIM-Signature headers are allowed and increase verification chances if one signature breaks in transit.
Does Outsolvi need DKIM changes?
No. Tracking pixel insertion happens before DKIM signing, so the signature remains valid. Outsolvi doesn't require DKIM configuration changes.
Related reading
More on email tracking
Glossary terms, comparisons, and feature deep-dives related to this guide.
Nate built Outsolvi after watching every email-tracking tool he had ever used lie to him about opens. Outsolvi runs Tier 1 to 5 confidence scoring on every open, native in Outlook and Gmail, so the number on the dashboard is one a rep can actually act on.
We update these pages when the underlying mechanics change. new mailbox-provider rules, new tracker behavior, new measurement gaps. The dates above are real revisions, not auto-touches.