An email authentication method that adds a digital signature, proving your email is genuine and was not changed after you sent it.
What Is DKIM?
DKIM stands for DomainKeys Identified Mail. It signs every email you send with a private digital key that only your domain has access to. The receiving inbox checks that signature against a public key sitting in your DNS.
Picture a wax seal on an old letter. If the seal is broken or missing, you know someone tampered with it. DKIM works the same way for email, except the check happens automatically, in a fraction of a second, every time an email lands in an inbox
Why DKIM Matters
Without DKIM, there is no way for Gmail, Yahoo, or Outlook to confirm your order confirmation or your Black Friday email actually came from you and not someone impersonating your store.
That matters twice as much in ecommerce. Customers already trust emails that look like they’re from a brand they bought from, which is exactly why store domains get spoofed. DKIM closes that gap, and it directly feeds into DMARC, which most inboxes now expect before they’ll trust bulk senders at all.
Skip it, and two things happen: your emails are easier to fake, and mailbox providers trust your domain a little less each time.
How DKIM Works
1. Your sending platform creates a unique signature based on your email’s content and a private key
2. That signature gets added to the email header as it goes out
3. The receiving server looks up your matching public key in your domain’s DNS
4. If the signature checks out, DKIM passes. If the email was altered in transit, it fails
You never see any of this happen. It runs in the background on every single send.
A Real DKIM Record
Host: adflipr._domainkey.yourstore.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSq…
Breaking it down:
– adflipr._domainkey is the selector, it tells the receiving server which key to check
– v=DKIM1 confirms the DKIM version
– p= is the actual public key your sending platform generated
You’ll get this exact record from whichever platform sends your email, whether that’s your marketing tool, your SMTP plugin, or your transactional email service.
How to Set It Up in Adflipr
1. Add your sending domain inside Adflipr
2. Adflipr automatically generates a DKIM record for that domain, no manual key generation needed
3. Copy that record into your DNS settings, through whichever host manages your domain (GoDaddy, Cloudflare, Namecheap, and so on)
4. Go back into Adflipr and click Verify
5. Adflipr checks your DNS in the background and confirms the moment the record is live, your DKIM status updates automatically, no separate checker tool needed
6. If you send from more than one domain, repeat this per domain, each one needs its own record and its own verify step
Best Practices
– Set up DKIM for every sending source, not just your main marketing platform
– Use a 2048-bit key if you’re generating one manually, 1024-bit is outdated
– Recheck DKIM status after switching email providers or hosting
– Pair it with SPF and DMARC, DKIM alone only tells half the story
Common Mistakes
– Assuming SPF alone covers authentication and skipping DKIM entirely
– Forgetting a second sending tool needs its own DKIM record, like a helpdesk or SMS platform that also sends email
– Copying the DNS record with a typo in the selector, which breaks verification silently
– Never testing after publishing, so a broken record goes unnoticed for weeks
Frequently Asked Questions
Add your sending domain inside your email platform, for example Adflipr, and it will generate the DKIM record for you. Paste that record into your domain’s DNS settings, then click Verify. Shopify and WooCommerce don’t manage this step directly, since it depends on whichever platform actually sends your marketing or transactional email.
It’s the prefix in the DNS record (like `adflipr._domainkey`) that tells receiving servers exactly which public key to check. Each sending platform uses its own selector, so switching platforms means a new DKIM record, not an edit to the old one.
Usually one of three things: the record hasn’t propagated yet, there’s a typo in the selector or key, or a second sending tool was never given its own record. A DKIM checker tool will usually point to the exact cause in seconds.
No. DKIM proves your email wasn’t altered, but mailbox providers also weigh sender reputation, engagement, and content. DKIM is necessary, not sufficient on its own, which is why it’s always paired with SPF and DMARC.
