DKIM Signature
A cryptographic signature proving an email really came from your domain and wasn't altered — one leg of the SPF/DKIM/DMARC tripod that decides deliverability.
What is a DKIM signature?
DKIM (DomainKeys Identified Mail) has your mail server sign outgoing messages with a private key; receivers fetch the public key from your DNS (selector._domainkey.yourdomain.com) and verify the signature. A valid signature proves two things: the message was authorized by the domain’s infrastructure, and the signed content (body plus chosen headers) wasn’t modified in transit. It’s authentication for email in a protocol family that shipped without any.
The tripod: DKIM, SPF, DMARC
DKIM rarely works alone. SPF lists which IPs may send for your domain; DKIM signs content; DMARC ties both to the visible From: address (alignment) and tells receivers what to do on failure — none, quarantine, or reject — plus sends you aggregate reports. The distinctions matter operationally: SPF breaks on forwarding (the forwarder’s IP isn’t yours) while DKIM survives it; DKIM breaks when mailing lists rewrite bodies. That’s why DMARC passes if either aligns. Gmail and Yahoo’s bulk-sender mandates made this stack effectively compulsory: no DKIM+DMARC, no inbox.
Operational realities
Every email SaaS you use (marketing platform, ticketing, CRM) sends “as you” and needs its own DKIM setup via CNAMEs — the sprawl is where gaps hide. Keys should be 2048-bit and rotated (selectors exist so new keys deploy alongside old). Start DMARC at p=none, read the reports, discover the senders you forgot existed, then ratchet to quarantine and reject.
What people get wrong
- Jumping straight to
p=rejectand silently killing invoices sent by that billing tool nobody documented. - Ignoring DMARC reports — they’re the discovery mechanism, not compliance mail.
- Assuming DKIM stops phishing broadly: it authenticates your domain; lookalike domains need separate defenses.
Primary source: RFC 6376 — DomainKeys Identified Mail
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.