Adelaide owned and operated, IT & Digital + Web since 2001→
WaTo Consulting

What is a DKIM record?

DKIM puts a digital signature on every email your business sends. The matching public key sits in your domain's DNS, so the receiving server can check the signature. If it checks out, the message really was signed by your domain and was not altered on the way.

Last updated

Call us(08) 7123 0805 Get a quoteNew work or advice Log a jobSomething not working?

The short answer

DKIM (DomainKeys Identified Mail) signs each outgoing email with a private key held by your mail provider. A DKIM record in your DNS publishes the matching public key under a name like selector._domainkey.yourdomain.com.au. Receivers use it to verify the signature. Google Workspace needs the key generated in the admin console and added as a TXT record. Microsoft 365 needs two CNAME records (selector1 and selector2) and signing switched on in the Defender portal. It works alongside SPF and DMARC.

Why DKIM matters

SPF checks which server sent a message. DKIM checks the message itself. The signature covers the sender and selected parts of the message, so it usually still verifies after forwarding, which SPF does not. DMARC accepts a message if either SPF or DKIM passes and lines up with the From domain, so a working DKIM signature is the safer of the two to rely on. The standard is RFC 6376.

The parts of DKIM

Private key (signing)

Held by your mail provider. It adds a signature header to each outgoing message. You never see it or publish it.

Public key (the DNS record)

Published in your DNS so anyone can verify the signature. Google uses a TXT record. Microsoft 365 uses CNAME records that point to keys Microsoft hosts.

Selector

A label that lets a domain have more than one key. Microsoft 365 uses selector1 and selector2. Google defaults to google. Each service that sends as you has its own selector.

Alignment

For DMARC, the domain that signed the message (the d= value) must match your From domain. A service that signs with its own domain passes DKIM but does not help DMARC.

Who this is for

  • Microsoft 365 or Google Workspace customers who were told DKIM is "not enabled" or "not signing".
  • Businesses whose email passes SPF but still lands in junk or fails DMARC.
  • Anyone who uses Xero, a CRM, a booking system or a newsletter tool that sends as their domain.
  • Owners who have been given a DKIM record by a provider and are not sure where it goes.

How to check your own DKIM

  1. Send yourself a test. Send an email from your business address to a personal Gmail or Outlook.com address. Open the full headers (Show original in Gmail).
  2. Look for dkim=pass. In the Authentication-Results line you want dkim=pass header.d=yourdomain.com.au. If you see dkim=none, the message was not signed. If the header.d domain is your provider's domain and not yours, it is signed but not aligned.
  3. Look the record up. For Microsoft 365 run nslookup -type=CNAME selector1._domainkey.yourdomain.com.au. For Google Workspace run nslookup -type=TXT google._domainkey.yourdomain.com.au. You should get an answer, not "non-existent domain".
  4. Check every sender. Repeat the test for each service that sends as you. Each one needs its own DKIM set up, using its own selector.

How WaTo can help

  • We switch DKIM on properly for Microsoft 365, Google Workspace and cPanel email, and check that every other sender signs as your domain.
  • We test with real messages and read the headers, so you know the signature passes and lines up, not just that a record exists.
  • If your records are right and mail to Outlook.com still bounces, see the 550 bounce guide.

Turning DKIM on, by platform

Microsoft 365. DKIM for a custom domain is not automatic. In the Microsoft Defender portal, open the DKIM settings for your domain. Defender shows two CNAME records, selector1._domainkey and selector2._domainkey, with the exact values to copy. Add both at your DNS host, wait for DNS to update, then switch Sign messages for this domain with DKIM signatures on. Until you do, Microsoft signs with its default onmicrosoft.com domain, which does not line up with your From address. Microsoft has changed the format of the record values over time, so copy what Defender shows rather than typing them from memory.

Google Workspace. In the Google Admin console go to Apps, Google Workspace, Gmail, Authenticate email. Choose your domain and generate a new record (2048-bit if your DNS host allows it). Add the TXT record it shows at your DNS host, then return and click Start authentication.

cPanel hosting. Open Email Deliverability in cPanel. If DKIM is not valid for the domain, use Manage and the repair or install option. If your DNS is hosted elsewhere, copy the suggested TXT record there.

Common DKIM mistakes

  • Added the records but never switched signing on. Microsoft 365 and Google both need a separate step after the DNS record exists.
  • DKIM not aligned. A third-party sender signs with its own domain. The signature is valid, but DMARC ignores it because the domain does not match your From address. Set up the service's custom-domain DKIM option.
  • Pasting the record wrongly. Some DNS hosts add your domain to the end of the name automatically, producing a doubled name such as selector1._domainkey.yourdomain.com.au.yourdomain.com.au. Others need a trailing dot. Check what actually resolves.
  • Long keys split badly. A 2048-bit key is longer than one DNS text string allows, so it must be split into quoted chunks. Most hosts do it for you. A broken split gives dkim=permerror.
  • Forwarding and mailing lists. A list that changes the subject or adds a footer can break the signature. A forwarder that does not alter the message usually keeps it intact.
  • Old keys never rotated. Keys should be swapped from time to time. Microsoft's two selectors exist so this can happen without a gap.

DKIM record questions

What is a DKIM record in simple terms?

It is the public half of a signature check. Your mail provider signs each message privately, and the DKIM record in your DNS lets anyone verify that signature.

What are selector1 and selector2 in Microsoft 365?

They are two DKIM key names. Microsoft 365 publishes two so it can rotate keys without breaking signing. You add both as CNAME records at your DNS host.

Is DKIM turned on automatically in Microsoft 365?

For your onmicrosoft.com address, yes. For your own domain, no. You add the CNAME records and enable signing in the Defender portal.

Do I need DKIM if I have SPF?

Yes. SPF breaks when mail is forwarded and does not check the visible From address. DKIM usually survives forwarding and gives DMARC something to align with.

Can I have more than one DKIM record?

Yes. Unlike SPF, a domain can have many DKIM records, one per selector. Each sending service normally has its own.

How do I know DKIM is working?

Send a test to an outside address and check the headers for dkim=pass with header.d set to your own domain.

How WaTo can help with this

Guides on this topic

Sources & references

WaTo Consulting. Last reviewed 2026-11-09. Review when Microsoft or Google change DKIM setup steps.

Book a call

DKIM not signing, or not sure which sender is missing? Book a call and have your domain name ready.

Mon to Fri, 8:30am to 5pm

Call (08) 7123 0805 Get a quote

No two businesses are the same, so nothing we do is off-the-shelf. Every solution is built around yours, and kept simple.

Questions

Frequently asked questions

How do your plans and pricing work?

Whatever suits you: a fixed contract, a monthly retainer, prepaid blocks of hours, or simple hourly rates. You pick the model that fits your business, and we keep it transparent with no surprise bills.

How quickly do you respond?

Fast. You talk to a real person, not a call queue. For urgent issues we're often on-site within the hour across Adelaide, with remote support Australia-wide.

Do you only do IT support?

No. IT & Digital, cyber security, websites & hosting, business solutions and currency equipment, all from one local team. One number to call.

What does it cost?

Managed IT is typically $80 to $200 per user per month. One-off help is $115 an hour remote or $180 an hour on site. Prices are ex GST. See our rates.

Do you support businesses outside Adelaide?

Yes. We're Adelaide-based with on-site visits across South Australia, remote support Australia-wide, and we fly in to clients in Darwin, Brisbane and elsewhere for planned work.

Will you work with our existing IT person?

Absolutely. We often co-manage, taking on monitoring, security and after-hours cover alongside your in-house team.

Why we're different

Not your typical IT company

We keep it simple, and fix things so they stay fixed, instead of patching them today.

A typical IT company
WaTo Consulting
You wait in a call queue
A real person on the WaTo team answers
One rigid plan, take it or leave it
Contract, retainer, blocks or hourly: your choice
Patch it today, deal with it again later
Fix the root cause, and what it could cause next
Jargon and over-engineering
Kept simple and explained in plain English
IT only, you juggle other vendors
IT, cyber, web, business & currency under one roof
Hosting resold from someone else
Our own Australian hosting, run by us
WaTo character, happy to help

Still not sure what you need?

Tell us what's slowing you down and we'll point you to the right fix. You're a partner, not a client.

Call (08) 7123 0805 Email info@wato.com.au
Why clients choose us

Trusted by Adelaide business since 2001

The WaTo team
Real people in Adelaide, not a call queue
  1. SA Construct · client from day one
    Our whole IT structure is with WaTo Consulting for the simple reason that there's no sales spiel, no waiting in line on the phone, and always an effective, quick result when needed.
  2. Wato

    From day one and still going 🤝

  3. Enzo's at Home · client since 2001
    WaTo has been assisting our company since 2001. Always punctual, trustworthy, honest, and can be relied on to get the job done.
  4. Wato

    Time flies when you're having fun 🙌

  5. Real estate business · client from 2010
    WaTo looked after IT for our property management business from 2010. We grew dramatically in that time and WaTo was instrumental in keeping all our IT in order, with smooth upgrades.
  6. Alyx

    Loved being part of the growth 📈

  7. Hospitality venue
    In a busy, large hospitality venue with constant IT issues, WaTo is an incredible asset. If WaTo's called with an issue, they're often here within the hour.
  8. Lee

    On my way 🚗

  9. Accounting practice
    WaTo has been invaluable in moving us from Outlook to Gmail and teaching us the other Google products. Friendly, approachable and easily understood. We've even brought WaTo in to help one of our own clients migrate.
  10. Lee

    Happy to help your clients too 🤝

  11. CRS · client since 2011
    Our data is the backbone of our company, and we sleep easy at night knowing it's safe and secure. Whenever we have an IT problem, WaTo understands how crippling downtime is and is quick to act.
  12. Alyx

    Backups checked. Sleep easy 😴

  13. Lasers in Medicine
    WaTo's IT expertise streamlined our medical practice, reduced operating costs and simplified our backups. 100% quality customer service to small business.
  14. Wato

    Small business is our thing 💪

  15. Engineering company
    Wato, or "DJ WaTo" as he's known to us, has become like family. He always goes above and beyond, with a few good solutions to our ever-demanding needs.
  16. Wato

    🎧 DJ WaTo, at your service

  17. City cafe, multiple locations
    WaTo set up our point of sale and internet. They always answered my calls and could even troubleshoot problems over the phone. Very professional. Thank you, WaTo!
  18. Lee

    Always happy to pick up 📞

  19. Printing industry · client since 2013
    Our business relies on discipline and attention to detail, which is exactly why we've relied on WaTo since 2013. Their knowledge and personal attention give us peace of mind in every area of our operation.
  20. Alyx

    Detail is our thing too 🔍

  21. Genmed 480
    We feel extremely lucky to have WaTo look after our computers. Easy to talk with, explains things in plain terms instead of jargon, and never pushes us to upgrade to the latest and greatest.
  22. Lee

    No jargon, promise 🙂

  23. Alex, 30 Acres · client since 2021
    If you're anything like us, IT is very daunting! WaTo took away the hassle and stress of setting up our brand new restaurant and installed our point of sale. Timely, efficient and a reasonable price. Highly recommended!
  24. Wato

    30 Acres, still the freshest food ever! 🍽️

  25. AV industry
    WaTo delivers for our standard office admin and as a consultant for integrating audio, visual and lighting products into the IT world. Problems are dealt with swiftly to avoid downtime.
  26. Lee

    Lights, camera, uptime 🎬

  27. Cummins Allison (CPI) · client since 2014
    Their ability to grasp and apply product-specific technical process has allowed us to meet all customer KPIs and offer value-added services.
  28. Alyx

    KPIs met. Keep counting 💵

  29. Allied health practice
    When the medical diary crashes, that's an all-out emergency. It happened three times in one year, and each time WaTo fixed it in under 10 minutes. Personal, reliable and fast.
  30. Alyx

    Diary's back up ✅

  31. Sports industry · client since 2015
    We've used WaTo since 2015. Before that, other providers made things difficult. WaTo is prompt, upfront and very reliable, and has saved us heaps!
  32. Lee

    Glad we could save you heaps 💸

  33. Sole owner-operator
    WaTo moved my site to a new server and set up secure, reliable email and hosting, so I could get on with what I do best. I'd send anyone to WaTo for all their wizardry needs.
  34. Wato

    Wizardry on tap 🪄

  35. Recreation industry
    WaTo did an amazing job setting up the audio and visual in our new business, and fantastic work migrating email accounts and managing our domains. Service is A+.
  36. Lee

    A+ right back at you ⭐

  37. Small home business
    Doesn't matter how small your business is, we all need help with IT and digital. WaTo makes me feel like BIG business.
  38. Alyx

    Small business, big support 🚀

  39. Mike Roberts
    As a non-geek, I appreciate that WaTo's always got my back and never makes me feel I'm imposing when I ring out of hours. Looking for someone local and reliable? WaTo's who you call!
  40. Wato

    Anytime, Mike 👍

Who we work with

Our story

Built in Adelaide, since 2001

WaTo Consulting was founded by John Watson in Adelaide in 2001. Over two decades it's earned a name for tailored work across a wide range of industries, helping businesses of every size run more smoothly, work more efficiently and grow steadily, without blowing the budget or disrupting the day-to-day. Rumour has it the story starts much earlier, with a young Wato on his grandfather's knee in front of a Commodore 64, learning to code in BASIC.

Emma Watson (née Dickenson) was part of the story for a stage along the way. She brought real estate and property management expertise, and a clear view of where the business could go: growing it, bringing in new systems and fresh thinking, and lifting the standard of how things are done. WaTo has been through plenty of shapes and stages since, but one thing she helped sharpen has never changed: being consistent for the client is a must.

Today it's all tailored, never off-the-shelf: IT & Digital, Business & Web Hosting, built around what each client actually needs. Over the years those areas have come together under one roof: our IT & Digital, Currency, Business and Web Hosting work now all sit within WaTo Consulting. One team, one standard, looking after the lot.

When you work with us, you're a partner, not just a client.

Call Us Contact Us Help
Need help?Now?