Glossary
EMAIL AUTH

DKIM

DomainKeys Identified Mail — an email authentication standard that uses public-key cryptography to sign outgoing messages, allowing receivers to verify the email came from the claimed domain and wasn't altered in transit.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. The sending mail server signs selected headers and the message body using a private key. The corresponding public key is published in DNS as a TXT record. Receiving servers fetch the public key and verify the signature — confirming the message is authentic and unmodified.

How It Works

  1. Sending server hashes selected headers + body
  2. Hashes with private key → DKIM-Signature header added to email
  3. Receiving server reads d= domain and s= selector from DKIM-Signature
  4. Looks up selector._domainkey.domain.com in DNS for public key
  5. Decrypts signature, recomputes hash, compares — PASS or FAIL

DNS Record Format

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqG..."

The selector (google) allows multiple keys — one per email service.

Importance

DKIM provides message integrity (wasn’t altered in transit) and signing domain proof (came from a server with the private key). Combined with DMARC alignment, it prevents From: address spoofing. Survives email forwarding better than SPF (which breaks when the envelope changes).

← All terms Learning hub →