What Is DKIM (DomainKeys Identified Mail)?

DKIM is an email authentication method that allows a sending domain to cryptographically sign outgoing messages, enabling receivers to verify that the message was not altered in transit and that it was authorized by the domain owner. DKIM is defined in RFC 6376 and is one of the three pillars of modern email authentication, alongside SPF and DMARC.

How DKIM Signing Works

When a mail server sends a message with DKIM enabled, it performs these steps:

1. Canonicalization. The message headers and body are normalized to a standard format (either "simple" or "relaxed") to account for minor modifications during transit, such as whitespace changes.
2. Hashing. The canonicalized body is hashed (typically SHA-256). Selected headers are also hashed.
3. Signing. The hash is encrypted with the domain's private key, producing a digital signature.
4. Header insertion. The signature is added to the message as a DKIM-Signature header, which includes metadata about the signing: the domain (d=), selector (s=), algorithm (a=), signed headers (h=), and the signature itself (b=).

The DKIM DNS Record

The public key used for verification is published as a DNS TXT record at selector._domainkey.domain.com. The selector is a label chosen by the domain owner, allowing multiple DKIM keys to coexist (e.g., for different mail services).

Example DNS record:

s1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEB..."

• v=DKIM1 -- Version identifier.
• k=rsa -- Key type (RSA is standard; Ed25519 is emerging).
• p= -- The base64-encoded public key.

What Gets Signed

The DKIM-Signature header specifies which message headers are included in the signature via the h= tag. Commonly signed headers include From, To, Subject, Date, and MIME-Version. The body hash covers the entire message body (or a specified length via the l= tag, though using l= is discouraged for security reasons).

Critically, the From header is always signed. This is what enables DKIM alignment checks in DMARC.

Verification Process

When a receiving mail server encounters a DKIM-Signature header:

1. It extracts the d= (domain) and s= (selector) values.
2. It queries DNS for the TXT record at selector._domainkey.domain.
3. It retrieves the public key from the p= tag.
4. It re-canonicalizes the message headers and body using the method specified in the signature.
5. It decrypts the signature using the public key and compares it to a freshly computed hash.
6. If they match, the DKIM check passes. If not, it fails.

Key Rotation

DKIM keys should be rotated periodically. Because the selector is part of the DNS lookup, you can publish a new key under a new selector, update your mail server to sign with the new key, and leave the old selector in DNS until all messages signed with it have been delivered or expired.

Verify Your DKIM Configuration

A missing or incorrect DKIM record means receivers cannot verify your signatures, weakening your authentication posture and potentially affecting deliverability at Gmail, Outlook, and Yahoo. Use our DKIM verification tool to check that your public key is published and valid.

Stay on top of your email infrastructure. Sign up for the InboxTooling newsletter for deliverability tips, tool updates, and best practices.