DKIM

Definition

DKIM adds a cryptographic signature to every outgoing message, calculated with a private key only the sending server holds. The matching public key is published in the domain's DNS, and the receiving server uses it to verify the signature.

What it adds that SPF does not

SPF authorizes servers; DKIM authenticates the message itself. The difference shows up on a forward: the relaying server's address is not in the SPF list so that check fails, while the signature stays valid. This is what makes a domain credible over time rather than only on direct sends.

The public key lives on a name containing a “selector”, a word chosen by the sending service. A domain can therefore carry several keys in parallel, one per sender, and rotate them without interruption: publish the new one, switch the signing over, retire the old one.

The public key, as it is published

A TXT record on a name that contains the selector.

selector1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQ..."

The selector — “selector1” here — also appears in the header of every signed message: that is how the receiving server knows which key to go and fetch. Without it the key cannot be found, and there is no way to guess it.

The usual mistake

Migrating a DNS zone by copying across the “important” lines and leaving the DKIM keys behind, because they are long and nobody knows what they do. Mail keeps going out, unsigned, and its reputation degrades slowly with no error raised anywhere.

How to avoid it: Treat “_domainkey” records like MX records: copy them in full, confirm they answer after the switch, and only delete a key once you have checked the sending service no longer uses it.

Source: DKIM is defined in RFC 6376: the signature travels in a message header, the public key is published as TXT under the “_domainkey” name.

Related terms

Where to go next

Knowing the words is half the job

The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.

Start for free

Five domains free, forever. No card required.

Back to the glossary