Table of Contents
DKIM (DomainKeys Identified Mail)
DomainKeys Identified Mail (DKIM) is an email authentication standard that uses digital signatures to verify that an email was authorized by the sending domain and that its contents have not been modified during transmission.
Unlike SPF, which verifies the sending server, DKIM verifies the integrity and authenticity of the message itself.
Why Is DKIM Needed?
Emails often pass through multiple mail servers before reaching the recipient.
During this journey, an attacker could attempt to modify the message.
DKIM allows the receiving mail server to detect whether the email has been altered.
How DKIM Works
DKIM uses public-key cryptography.
The sending mail server:
- Computes a digital signature over selected parts of the email.
- Signs the message using its private key.
- Adds the signature to the email header.
The receiving server:
- Reads the DKIM signature.
- Retrieves the public key from DNS.
- Verifies the signature.
- Determines whether the message has been modified.
Simplified Process
Mail Server ↓ Create Digital Signature ↓ Private Key ↓ Email Sent ↓ Recipient Server ↓ Retrieve Public Key from DNS ↓ Verify Signature
If verification succeeds, the message passes DKIM.
Public Key in DNS
The public key is stored as a DNS TXT record.
Example:
selector1._domainkey.example.com
Typical record:
v=DKIM1; k=rsa; p=MIIBIjANBgkqh...
The receiving server queries this DNS record to obtain the public key.
What Is a Selector?
A selector identifies which DKIM key was used.
Example:
selector1._domainkey.example.com
Another selector might be:
mail2026._domainkey.example.com
Selectors make it possible to rotate keys without interrupting email delivery.
DKIM-Signature Header
A DKIM-signed email contains a header similar to:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; bh=...; b=...
Common fields:
| Field | Meaning |
|---|---|
| v | DKIM version |
| a | Signing algorithm |
| d | Signing domain |
| s | Selector |
| bh | Body hash |
| b | Digital signature |
DKIM Results
Mail servers usually report one of these results:
| Result | Meaning |
|---|---|
| Pass | Signature verified successfully |
| Fail | Signature verification failed |
| None | No DKIM signature present |
| TempError | Temporary DNS problem |
| PermError | Invalid DKIM signature or record |
What Does DKIM Protect?
DKIM helps verify:
- The email was authorized by the sending domain.
- The signed parts of the email have not been modified.
It does not:
- Encrypt the email.
- Hide the sender.
- Prevent spam by itself.
DKIM and Email Forwarding
Unlike SPF, DKIM usually survives email forwarding because the digital signature remains valid as long as the signed portions of the message are not modified.
However, if a forwarding service changes the signed headers or body (for example by adding a disclaimer), DKIM verification may fail.
DKIM and Telenegar
The Telenegar Mail Check service can verify:
- Whether a DKIM record exists
- DKIM selector
- Public key availability
- Key length
- Record syntax
- Common configuration errors
This helps improve email authentication and deliverability.
SPF vs DKIM
| SPF | DKIM |
|---|---|
| Verifies the sending server | Verifies the email signature |
| Uses sender IP address | Uses public/private keys |
| May fail after forwarding | Usually survives forwarding |
| Stored as DNS TXT record | Public key stored as DNS TXT record |
Both technologies complement each other.
Common Misconceptions
- DKIM encrypts email.
- False. DKIM signs the email but does not encrypt it.
- DKIM prevents spam.
- False. It verifies authenticity but does not determine whether a message is spam.
- DKIM replaces SPF.
- False. Modern email systems normally use both.
Best Practices
- Use at least a 2048-bit RSA key when supported.
- Rotate DKIM keys periodically.
- Use meaningful selector names.
- Publish only one valid public key for each selector.
- Deploy DKIM together with SPF and DMARC.