DKIM

DKIM (DomainKeys Identified Mail) is an email authentication standard in which the outgoing mail server attaches a cryptographic signature to every message, tied to the sender's domain. The receiving server validates that signature against a public key published in the domain's DNS zone, confirming two things at once: the mail genuinely originates from the signing domain, and its signed content has not been tampered with in transit.

How DKIM works

DKIM relies on asymmetric cryptography — a private/public key pair, typically RSA (2048-bit minimum recommended) or Ed25519:

1. The administrator generates the key pair. The private key stays on the mail server; the public key is published as a TXT record at selector._domainkey.example.com.
2. On every send, the server hashes selected headers and the message body, encrypts the hash with the private key, and adds the result as a DKIM-Signature header. Key tags include the signing domain (d=), the selector (s=) and the list of signed headers (h=).
3. The receiver looks up the public key named by the selector, decrypts the signature and recomputes the hash. If they match, the message earns DKIM=PASS.

Selectors make key management flexible: a company can run separate keys for its own mail server and for a newsletter platform, and rotate keys without downtime by publishing a new selector before retiring the old one.

DKIM in practice

DKIM has effectively become mandatory. Since 2024 Gmail and Yahoo require authentication from bulk senders, and unsigned mail suffers heavily in deliverability. Setup is usually straightforward: hosting control panels generate the keys and even the DNS record with one click; with an external DNS provider you paste the TXT record manually. Verification is equally simple — send a test message to Gmail and inspect "Show original" for the DKIM result.

Two caveats matter. First, forwarding usually preserves DKIM (unlike SPF), because the signature travels inside the message — one reason DMARC treats a valid aligned DKIM signature as sufficient. Second, mailing lists that modify subjects or footers break signatures, which list software mitigates by re-signing with its own domain.