Implement DKIM Keys for Third-Party Senders

Reading the documentation for each Sender (as in the Salesforce example in Request DKIM Signing From Third-Party Owners), the process often involves:

• Generating a key pair
• Choosing a selector for a domain
• Publishing the public key in DNS

For DKIM keys, the specification defines that:

• The name of the TXT file is formed from the selector, followed by “._”, then the domain key, followed by “.”, and then the domain name. For example: selector._domainkey.domain.com.
• The value in the TXT file is in the format v=DKIM1; k=rsa; p=MHww..., where the value after p= is the contents of the public key.

You’re now ready to move on to the next Approved, Well-known Sender for your selected domain. Repeat the above steps for the next Approved, Well-known Sender, updating your DNS TXT records accordingly.

NOTE: Many 3rd-party Senders enable DKIM signing by default. For example, Microsoft Office365 and Google G Suite enable DKIM signing for outgoing messages automatically.