What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. Receivers verify it with a public key published in the sender's DNS, proving the message was authorised by that domain and not modified in transit.

The sending server signs selected headers and the body with a private key and adds a DKIM-Signature header. The header names the signing domain (d=) and a selector (s=). The receiver fetches the public key from the TXT record at selector._domainkey.domain and verifies the signature.

Selectors allow several keys to exist at once: one per sending service, or an old and a new key during rotation. This also means DKIM cannot be discovered from the domain name alone. A tool can only check a DKIM record if it knows the selector, which is found in the DKIM-Signature header of a real message.

Unlike SPF, a DKIM signature usually survives forwarding, because it travels with the message. It breaks when an intermediary, typically a mailing list, changes the subject or body. Keys of 2048 bits are the sensible choice today. By itself DKIM does not tell receivers what to do with unsigned mail; DMARC provides that policy.

Example

sel1._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=<public key>"

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=sel1; h=from:to:subject; bh=...; b=...

Check it

See how DKIM looks for a real domain:

MX lookup