Skip to main content
dkim PROTOCOLHost: BIND / Named RFC Zone FileStandard: RFC 6376

How to Configure DomainKeys Identified Mail (DKIM) on BIND / Named RFC Zone File

Cryptographically signs outbound emails using public/private key pairs to prove message integrity and authenticate sender domain. Follow this verified implementation guide to deploy standard compliant DKIM DNS records in BIND / Named RFC Zone File.

Default DKIM Record Syntax

// Authoritative RFC Example
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...

Configuration Steps in BIND / Named RFC Zone File

  1. 1Open the authoritative BIND zone file on your nameserver (/etc/bind/zones/db.domain).
  2. 2Locate the orphaned CNAME or NS entry.
  3. 3Comment out or delete the entire resource record line.
  4. 4Increment the SOA serial number (YYYYMMDDNN format).
  5. 5Execute `named-checkzone` to validate syntax and reload with `rndc reload`.

Verification Checklist (RFC 6376)

Query the DNS selector TXT/CNAME record at <selector>._domainkey.yourdomain.com.
Validate key length (minimum 2048-bit RSA recommended, 1024-bit deprecated).
Confirm public key matching against outbound SMTP signature headers.
Ensure CNAME delegation targets an active, valid ESP key repository.
Live Validation Engine

Validate Your BIND / Named RFC Zone File DKIM Record

Verify propagation, check syntax formatting, and audit recursive lookups in 60 seconds with SubDomainWatch.

Run Free DNS Validator