DKIM Key

A DKIM Key is used to digitally sign outbound emails for a domain. DKIM improves deliverability by allowing recipients to verify email authenticity.

Schema

interface DkimKey {
  id: string; // "dkm_..." - Unique identifier
  domain_id: string; // Associated domain
  selector: string; // DNS selector (e.g., "default")
  is_active: boolean; // Currently signing emails
  dns_record_name: string; // Full DNS record name
  dns_record_value: string; // Public key for DNS
  created_at: string;
  updated_at: string;
}

Properties

Property	Type	Description
`id`	`string`	KSUID with `dkm_` prefix
`domain_id`	`string`	Domain this key belongs to
`selector`	`string`	DKIM selector prefix
`is_active`	`boolean`	Used for signing
`dns_record_name`	`string`	DNS TXT record name
`dns_record_value`	`string`	Public key value
`created_at`	`string`	Creation timestamp
`updated_at`	`string`	Last update timestamp

DNS Configuration

Add TXT record for DKIM:

Record Type	Name	Value
TXT	`{selector}._domainkey.example.com`	`v=DKIM1; k=rsa; p={public_key}`

Key Rotation

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  Create     │────▶│  Activate   │────▶│  Deactivate │
│  New Key    │     │  New Key    │     │  Old Key    │
└─────────────┘     └─────────────┘     └─────────────┘

Only one key can be active per domain.

Example

{
  "id": "dkm_2kHfPZcN9xW4mE8RtY7vB",
  "domain_id": "hst_1jGePYbM8wV3lD7QsX6uA",
  "selector": "default",
  "is_active": true,
  "dns_record_name": "default._domainkey.example.com",
  "dns_record_value": "v=DKIM1; k=rsa; p=MIGfMA0GCS...",
  "created_at": "2026-01-15T10:30:00Z",
  "updated_at": "2026-01-15T10:30:00Z"
}

Domain - Domain configuration
Email - Email infrastructure