The key sits in a TXT record at a name made from a selector and your domain, in the form selector._domainkey.example.com. Your mail provider chooses the selector and generates the key, and you publish the record they give you. You don't write it yourself.
Selectors are what let a domain hold more than one key at a time. That's how several sending services can each sign with their own key, and how a key gets replaced safely: the new one is published before the old one is retired, so mail already on its way still verifies.
Because the signature travels inside the message, it usually survives being relayed, since relays typically don't change the content. A service that does rewrite a message on the way can break the signature, though. DMARC accepts a pass from either SPF or DKIM, so the two cover for each other.
Updated September 2026
Check it yourself