DKIM record
The TXT record at selector._domainkey.domain that publishes a DKIM public key, with tags such as v=DKIM1, k for the key type and p for the key.
What it means
A DKIM record holds the public half of a signing key. Its tags: v=DKIM1 (recommended, and first if present), k (key type, rsa by default, or ed25519), p (the base64 public key, required), h (hash algorithms allowed), s (service type), t (flags) and n (notes). t=y marks the domain as testing DKIM, and verifiers must then treat its signed mail like unsigned mail. t=s forbids the i= domain from being a subdomain of d=.
An empty p= means the key has been revoked: signatures using that selector must fail. That is the clean way to retire a key whose private half may have leaked.
A 2048-bit RSA key is longer than the 255-character limit of one TXT string, so it is published as several strings in one record, which DNS hosts handle differently. Providers often ask for a CNAME at the selector instead, pointing to a record they manage.
Example
mail2026._domainkey.example.com. TXT "v=DKIM1; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes