DKIM Signature

What is a DKIM signature?

DKIM (DomainKeys Identified Mail) has your mail server sign outgoing messages with a private key; receivers fetch the public key from your DNS (selector._domainkey.yourdomain.com) and verify the signature. A valid signature proves two things: the message was authorized by the domain’s infrastructure, and the signed content (body plus chosen headers) wasn’t modified in transit. It’s authentication for email in a protocol family that shipped without any.

The tripod: DKIM, SPF, DMARC

DKIM rarely works alone. SPF lists which IPs may send for your domain; DKIM signs content; DMARC ties both to the visible From: address (alignment) and tells receivers what to do on failure — none, quarantine, or reject — plus sends you aggregate reports. The distinctions matter operationally: SPF breaks on forwarding (the forwarder’s IP isn’t yours) while DKIM survives it; DKIM breaks when mailing lists rewrite bodies. That’s why DMARC passes if either aligns. Gmail and Yahoo’s bulk-sender mandates made this stack effectively compulsory: no DKIM+DMARC, no inbox.

Operational realities

Every email SaaS you use (marketing platform, ticketing, CRM) sends “as you” and needs its own DKIM setup via CNAMEs — the sprawl is where gaps hide. Keys should be 2048-bit and rotated (selectors exist so new keys deploy alongside old). Start DMARC at p=none, read the reports, discover the senders you forgot existed, then ratchet to quarantine and reject.

What people get wrong

• Jumping straight to p=reject and silently killing invoices sent by that billing tool nobody documented.
• Ignoring DMARC reports — they’re the discovery mechanism, not compliance mail.
• Assuming DKIM stops phishing broadly: it authenticates your domain; lookalike domains need separate defenses.

Primary source: RFC 6376 — DomainKeys Identified Mail

How DKIM Verification Works

When a receiving mail server gets an email with a DKIM signature, it looks up the sending domain’s public key via a DNS TXT record (published at a predictable location like selector._domainkey.example.com), and uses that public key to verify the signature against the email’s actual content. If the signature verifies successfully, the receiving server can be confident the email genuinely originated from a server authorized by the claimed sending domain and that its content (specifically the headers and body fields covered by the signature) wasn’t altered in transit. DKIM is typically deployed alongside SPF and DMARC as part of a complete email authentication strategy — DKIM alone verifies message integrity and sender authorization, but DMARC is what tells receiving servers what to actually do (quarantine, reject, or allow) with messages that fail DKIM or SPF checks.