Is DKIM more important than SPF?

They fail in different situations, and DKIM fails in fewer. SPF breaks when mail is forwarded, because the forwarding server is not in your record; a DKIM signature travels with the message and still verifies. For that reason DKIM is often what keeps DMARC passing for forwarded mail, but the two are complementary rather than ranked.

Can I have more than one DKIM record?

Yes, and most domains should. Each sending service uses its own selector, and each selector is a separate DNS name, so multiple DKIM records do not conflict. This is the opposite of SPF, where exactly one record is allowed.

ConceptDKIM

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send, letting a receiver verify the message really came from your domain and was not altered in transit. You publish a public key in DNS; your mail server signs outgoing mail with the matching private key; the receiver fetches the public key and checks the signature. Unlike SPF, a DKIM signature travels with the message, so it still verifies after the mail is forwarded, which is why DKIM is usually what keeps DMARC passing for forwarded mail.

See it on your own domainDKIM checker

How DKIM verification works

When your server sends a message it adds a DKIM-Signature header containing a domain (d=) and a selector (s=). The receiver uses those to fetch a public key from selector._domainkey.yourdomain.com, then checks that the signature matches the message body and signed headers. If it does, DKIM passes and the receiver knows the message genuinely came from your domain and was not modified. Because the signature is part of the message, forwarding does not break it the way it breaks SPF.

Selectors, and why a checker cannot guess them

The selector is chosen by whatever signs your mail, and there is no way to list a domain's selectors from DNS, so any checker can only probe the selector names the major providers are known to use. If your provider uses a generated selector (Amazon SES does), you have to supply it. You can always find your selector by opening a message you sent and reading the s= value in its DKIM-Signature header.

Key strength and alignment

Use a 2048-bit key; 1024-bit is now considered weak and some receivers discount it. Two things also matter for DMARC: the signing domain in d= must align with your visible From: domain, and a provider that signs with its own domain produces a valid signature that does not align, so DMARC still fails. Signing must happen with your domain for the signature to count toward DMARC.

Common questions

Is DKIM more important than SPF?: They fail in different situations, and DKIM fails in fewer. SPF breaks when mail is forwarded, because the forwarding server is not in your record; a DKIM signature travels with the message and still verifies. For that reason DKIM is often what keeps DMARC passing for forwarded mail, but the two are complementary rather than ranked.
Can I have more than one DKIM record?: Yes, and most domains should. Each sending service uses its own selector, and each selector is a separate DNS name, so multiple DKIM records do not conflict. This is the opposite of SPF, where exactly one record is allowed.
What is DKIM alignment?: DMARC requires that the domain in the signature's d= tag matches the domain in the visible From: address. A provider signing with its own domain produces a valid signature that does not align, so DMARC still fails even though DKIM passed. Signing with your own domain is what makes DKIM count for DMARC.