Beamfar
Sign inStart the 14-day trial

What is DKIM (DomainKeys Identified Mail)?

Last updated .

DKIM (DomainKeys Identified Mail) lets a sending server sign each message. The signature names a domain and a selector; the receiver reads the public key from a TXT record at selector._domainkey.example.com and checks the signature. RFC 6376 defines it.

Definition
DKIM
A signature added to outgoing email and verified by a public key published in DNS, proving the message was not altered and came from the domain.

What breaks it

Deleting the selector record, replacing the nameservers without copying it, or a mail provider that rotates keys and expects a new record you never published. The message then fails DKIM verification, which matters most when DMARC relies on DKIM alignment.

How it fits with SPF and DMARC

SPF says which servers may send. DKIM proves the content is intact and signed by the domain. DMARC combines the results and tells receivers what to do when they fail. A domain usually needs all three.

An example

default._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..." is a DKIM selector record named default. The sending service signs each message with the matching private key and adds a DKIM-Signature header that names d=example.com; s=default. Run dig TXT default._domainkey.example.com +short to test: an empty answer means the record is missing, and mail signed with that selector fails verification. A provider that rotates keys may ask for a new selector name, so publish every selector it gives you.

DKIM does not say a message is wanted, only that it was signed by the domain it names; a spammer can sign messages with their own domain. That is why DMARC checks that the signing domain aligns with the visible From address.

What to check

That each sending service has its selector record in DNS, and the Authentication-Results header of a test message shows dkim=pass.

Sources

Read on . Standards and vendor pages change; confirm the current text before you rely on it.

Guides that use this term

  • SPFSPF is a DNS record listing the servers allowed to send email for a domain. The one-record rule, the ten-lookup limit and the mistakes that make mail fail.
  • DMARCDMARC is a DNS policy that tells receivers what to do with email that fails SPF and DKIM alignment: nothing, quarantine or reject. Why strict policies amplify DNS mistakes.
  • DNS recordA DNS record is one entry in a domain’s zone that maps a name to data such as an address, a mail server or a text value. The common types and what breaks when one changes.

Know first. Know why. Tell your client before they call.

Paste your client list. Both regions start checking.

Start the 14-day trialWhat Beamfar watches

No card for the trial.