What is a DKIM public key and private key?

DKIM uses a key pair: two mathematically linked keys that work together. One stays private. One gets published for anyone to see. That's the entire basis of how DKIM proves your email is legitimate.

The private key lives on your mail server (or your ESP's servers if they sign on your behalf). It never leaves. You use it to generate the cryptographic signature that gets attached to every email you send. Because the private key is secret, only someone who controls it can produce a valid DKIM signature for your domain. That's the "proof of origin" part.

The public key is published in your DNS as a TXT record at selector._domainkey.yourdomain.com. Anyone, including receiving mail servers, can retrieve it. When a receiving server gets your message, it uses the public key to verify the signature. If the math works out, the signature is genuine. If not, something's wrong.

The clever part is the asymmetry: you can only create a valid signature with the private key, but you can verify it with the public key. That means receiving servers don't need any kind of shared secret with you. They just look up your public key from DNS, which is public by design.

In practice, if you're using an ESP, they typically manage the private key on their end and provide you with the public key TXT record to publish in your DNS. You never see or handle the private key directly. When you switch ESPs, you'll publish a new public key under a new selector and retire the old one.

Key length matters too: you want a 2048-bit key, not 1024-bit. The longer the key, the harder it is to reverse-engineer the private key from the public one. Our free DKIM checker will tell you your current key length and whether your record is valid. And if you want to understand how these keys get used in the actual signing process, see how DKIM works.