# What is DKIM?

> DKIM (DomainKeys Identified Mail) is a cryptographic signature on each message. EmailPal publishes two keys per domain — RSA-2048 and Ed25519 — and signs outbound mail with them.

Source: https://emailpal.io/help/what-is-dkim

## In one sentence

DKIM lets a receiver prove the message was signed by a key published on your domain, and that the signed parts were not altered in transit.

## What EmailPal publishes

Two selectors:

- `rsa._domainkey` — RSA-2048
- `ed._domainkey` — Ed25519

Outbound mail is signed. Receivers that understand either key can verify. Dual-key is deliberate: some older filters still want RSA; Ed25519 is smaller and modern.

## "DKIM not found"

The selector in the message (`d=` / `s=` in the signature) must match a TXT record that actually exists on the public internet. If you copied records by hand and missed one selector, one of the two signatures will fail.

Fix: [DKIM not validating](/help/dkim-not-validating).

## How it fits with SPF and DMARC

[SPF](/help/what-is-spf) checks the sending IP. DKIM checks the signature. [DMARC](/help/what-is-dmarc) wants at least one of those to align with the From domain.

## FAQs

### Do I generate a DKIM key in Google Workspace?

Not for EmailPal-hosted mailboxes. We generate and publish the keys. Google-hosted mailboxes you connected for warming keep Google's DKIM on Google's domain or on your Workspace domain — that is a different path.

### Can I use one selector?

We publish two. Leave both in place.

## Need more help?

[How to set up DNS records (MX, SPF, DKIM, DMARC)](/help/how-to-set-up-dns-records-mx-spf-dkim-dmarc).