What the standard says
DKIM, short for DomainKeys Identified Mail, is defined in RFC 6376 [1]. Your email service signs each outgoing message with a private key, and receivers check the signature using a public key published in your DNS [1]. A valid signature means the message came from a server holding your key and wasn’t altered in transit [1].
A domain can publish more than one key using names called selectors. That lets a provider switch to a new key without breaking mail, and lets different services sign with their own keys [1]. Because the signature travels inside the message, DKIM usually survives forwarding better than SPF does [1].
DKIM isn’t always on by default. Microsoft 365 signs mail for its own onmicrosoft.com addresses automatically, but for your own domain you add two DNS records and turn DKIM on [2]. Microsoft uses two keys so it can rotate between them, and a rotation takes about four days to finish [2].
What you’ll hear
“DKIM encrypts your email so nobody can read it.”
That’s a common mix-up. DKIM signs messages; it proves who sent them and that they weren’t changed. Anyone handling the message can still read it [1].
The fair version of the concern is about delivery. Gmail asks everyone sending to Gmail accounts to use SPF or DKIM, and asks bulk senders for both [3]. Mail without a valid signature has less going for it when filters decide where it lands.
What the numbers say
There’s no reliable public study measuring how many small businesses sign their email with DKIM, so this page doesn’t give a percentage. These are the numbers that matter when you set it up:
1024 bits: the minimum key size the standard requires for long-lived keys [1], and Gmail’s minimum for sending to personal Gmail accounts [3].
2048 bits: the key size Gmail recommends where your provider supports it [3].
96 hours: how long a DKIM key rotation takes to finish in Microsoft 365 [2].
5,000: messages a day to Gmail accounts, the point where Google requires both SPF and DKIM [3].
Publisher: the standards body or vendor listed. Funder: not applicable (standards and vendor documentation, not studies). Fit for a small business: direct; these are the settings your provider has to meet.
What we’ve seen
We haven’t run into this yet.
Putting it together
DKIM is a signature, not a lock. It proves a message came from your domain unchanged, which matters more as providers lean on authentication to filter mail. The usual gap isn’t the main mailbox; it’s the other services that send as you, like billing systems and newsletter tools, which each need DKIM turned on separately. NIST includes DKIM in its guidance on trustworthy email [4].
What good looks like
DKIM turned on and passing for your main email service on your own domain, not just the provider’s default.
Every other service that sends as you signs with DKIM too.
2048-bit keys where supported.
SPF and DMARC in place alongside it. See What is SPF, and why one record matters and DMARC.
Questions for your IT resource
Is DKIM turned on for our own domain?
Which services send email as us, and do they all sign with DKIM?
What key size are we using?
Who checks that signing still works after we change providers?
Related learning
What is DMARC?
DMARC is a DNS record that tells other mail servers what to do with email that claims to come from your domain but can’t prove it.
What is SPF, and why one record matters
SPF is a DNS record that lists the servers and services allowed to send email for your domain. Receiving mail servers check it to decide whether a message really came from someone you approved.
Sources
IETF, RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, September 2011. (checked 2026-10-07)
Microsoft, Set up DKIM to sign mail from your Microsoft 365 domain, Microsoft Learn. (checked 2026-10-07)
Google, Email sender guidelines, Gmail Help. (checked 2026-10-07)
NIST, SP 800-177 Rev. 1: Trustworthy Email, February 2019. (checked 2026-10-07)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.