DNS and authentication
What is DKIM?
DKIM (DomainKeys Identified Mail) is a cryptographic signature on each message. EmailPal publishes two keys per domain — RSA-2048 and Ed25519 — and signs outbound mail with them.
In one sentence
DKIM lets a receiver prove the message was signed by a key published on your domain, and that the signed parts were not altered in transit.
What EmailPal publishes
Two selectors:
rsa._domainkey— RSA-2048ed._domainkey— Ed25519
Outbound mail is signed. Receivers that understand either key can verify. Dual-key is deliberate: some older filters still want RSA; Ed25519 is smaller and modern.
"DKIM not found"
The selector in the message (d= / s= in the signature) must match a TXT record that actually exists on the public internet. If you copied records by hand and missed one selector, one of the two signatures will fail.
Fix: DKIM not validating.
How it fits with SPF and DMARC
SPF checks the sending IP. DKIM checks the signature. DMARC wants at least one of those to align with the From domain.
FAQs
Do I generate a DKIM key in Google Workspace?
Not for EmailPal-hosted mailboxes. We generate and publish the keys. Google-hosted mailboxes you connected for warming keep Google's DKIM on Google's domain or on your Workspace domain — that is a different path.
Can I use one selector?
We publish two. Leave both in place.