DNS and authentication
What is DKIM?
DKIM (DomainKeys Identified Mail) is a cryptographic signature on each message. EmailPal publishes two keys per domain — RSA-2048 and Ed25519 — and signs outbound mail with them.
In one sentence
DKIM lets a receiver prove the message was signed by a key published on your domain, and that the signed parts were not altered in transit.
What EmailPal publishes
Two selectors, each named with a date:
rsa<YYYYMMDD>._domainkey— RSA-2048, for examplersa20261007._domainkey.example.comed<YYYYMMDD>._domainkey— Ed25519, for exampleed20261007._domainkey.example.com
The date makes the names unique per key, so they differ between domains and change when a key is rotated. Copy the exact records shown in your dashboard.
Outbound mail is signed. Receivers that understand either key can verify. Dual-key is deliberate: some older filters still want RSA; Ed25519 is smaller and modern.
"DKIM not found"
The selector in the message (d= / s= in the signature) must match a TXT record that actually exists on the public internet. If you copied records by hand and missed one selector, one of the two signatures will fail.
Fix: DKIM not validating.
How it fits with SPF and DMARC
SPF checks the sending IP. DKIM checks the signature. DMARC wants at least one of those to align with the From domain.
FAQs
Do I generate a DKIM key in Google Workspace?
Not for EmailPal-hosted mailboxes. We generate and publish the keys. If you connect an existing Google Workspace mailbox with an app password instead, its DKIM stays in your Google admin console and EmailPal does not publish or manage it.
Can I use one selector?
We publish two. Leave both in place.