DKIM (DomainKeys Identified Mail)

DomainKeys Identified Mail (DKIM) is an email authentication standard that uses digital signatures to verify that an email was authorized by the sending domain and that its contents have not been modified during transmission.

Unlike SPF, which verifies the sending server, DKIM verifies the integrity and authenticity of the message itself.

Emails often pass through multiple mail servers before reaching the recipient.

During this journey, an attacker could attempt to modify the message.

DKIM allows the receiving mail server to detect whether the email has been altered.

DKIM uses public-key cryptography.

The sending mail server:

• Computes a digital signature over selected parts of the email.
• Signs the message using its private key.
• Adds the signature to the email header.

The receiving server:

• Reads the DKIM signature.
• Retrieves the public key from DNS.
• Verifies the signature.
• Determines whether the message has been modified.

Mail Server

↓

Create Digital Signature

↓

Private Key

↓

Email Sent

↓

Recipient Server

↓

Retrieve Public Key from DNS

↓

Verify Signature

If verification succeeds, the message passes DKIM.

The public key is stored as a DNS TXT record.

Example:

selector1._domainkey.example.com

Typical record:

v=DKIM1;
k=rsa;
p=MIIBIjANBgkqh...

The receiving server queries this DNS record to obtain the public key.

A selector identifies which DKIM key was used.

Example:

selector1._domainkey.example.com

Another selector might be:

mail2026._domainkey.example.com

Selectors make it possible to rotate keys without interrupting email delivery.

A DKIM-signed email contains a header similar to:

DKIM-Signature:
v=1;
a=rsa-sha256;
d=example.com;
s=selector1;
bh=...;
b=...

Common fields:

Mail servers usually report one of these results:

DKIM helps verify:

• The email was authorized by the sending domain.
• The signed parts of the email have not been modified.

It does not:

• Encrypt the email.
• Hide the sender.
• Prevent spam by itself.

Unlike SPF, DKIM usually survives email forwarding because the digital signature remains valid as long as the signed portions of the message are not modified.

However, if a forwarding service changes the signed headers or body (for example by adding a disclaimer), DKIM verification may fail.

The Telenegar Mail Check service can verify:

• Whether a DKIM record exists
• DKIM selector
• Public key availability
• Key length
• Record syntax
• Common configuration errors

This helps improve email authentication and deliverability.

Both technologies complement each other.

• DKIM encrypts email.
  • False. DKIM signs the email but does not encrypt it.

• DKIM prevents spam.
  • False. It verifies authenticity but does not determine whether a message is spam.

• DKIM replaces SPF.
  • False. Modern email systems normally use both.

• Use at least a 2048-bit RSA key when supported.
• Rotate DKIM keys periodically.
• Use meaningful selector names.
• Publish only one valid public key for each selector.
• Deploy DKIM together with SPF and DMARC.

• SPF
• DMARC
• DNS Explained
• Mail Check

email dkim dns authentication smtp mail security