What is DKIM in email?

DKIM (DomainKeys Identified Mail) is an email authentication protocol that adds a cryptographic digital signature to outgoing emails. Receiving servers verify this signature against a public key published in DNS, confirming the email was authorized by the domain owner and hasn't been tampered with.

How does DKIM verify email integrity?

DKIM creates a hash of the email body and selected headers, then signs it with a private key. The receiving server computes its own hash and compares it to the decrypted signature. If they match, the message hasn't been altered in transit.

What is a DKIM selector?

A DKIM selector is a string used to locate the public key in DNS. The public key is published as a TXT record at selector._domainkey.yourdomain.com. Selectors allow domains to use multiple DKIM keys simultaneously, such as different keys for different email services.

What is the difference between RSA and Ed25519 DKIM keys?

RSA keys (rsa-sha256) are universally supported but require larger key sizes (2048-bit recommended). Ed25519 keys (ed25519-sha256) offer stronger security with much smaller 256-bit keys and faster performance, but are not yet supported by all email providers.

Do I need DKIM if I already have SPF?

Yes. SPF verifies the sending server's IP address but doesn't protect message content. DKIM verifies both the sender's domain and message integrity. Together with DMARC, they provide comprehensive email authentication. DKIM also survives email forwarding, unlike SPF.

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication protocol that uses cryptographic signatures to verify that an email was sent by an authorized server and that its content has not been altered in transit.

DKIM at a Glance

Digital Signatures

Attaches a cryptographic signature to every outgoing email, proving it was authorized by the domain owner

Message Integrity

Guarantees that the email body and key headers have not been modified after the message was signed

Domain Verification

Receivers verify signatures against the public key published in DNS, confirming domain ownership

How DKIM Works

Message Signed

The sending mail server generates a cryptographic hash of the email body and selected headers, then signs it with the domain's private key.

Signature Attached

The signature is added as a DKIM-Signature header to the email, along with metadata like the selector and signing domain.

Public Key Lookup

The receiving server uses the selector and domain from the signature to query DNS for the corresponding public key record.

Signature Verified

The receiver decrypts the signature with the public key and compares it against its own hash of the message. A match confirms authenticity and integrity.

Signature Components

d= (Domain)

The signing domain claiming responsibility

s= (Selector)

Points to the specific DNS key record

b= (Signature)

The Base64-encoded cryptographic signature

bh= (Body Hash)

Hash of the canonicalized message body

History Timeline

2004

DomainKeys by Yahoo

Yahoo developed DomainKeys, the predecessor to DKIM, introducing the concept of cryptographic email signatures tied to domain DNS records. Cisco simultaneously developed Identified Internet Mail.

2007

RFC 4871 Published

DomainKeys and Identified Internet Mail were merged into DKIM and published as RFC 4871, creating a unified standard for cryptographic email authentication.

View RFC 4871

2011

RFC 6376 — Internet Standard

DKIM was updated and elevated to Internet Standard with RFC 6376, superseding RFC 4871. This version clarified canonicalization, key management, and signature verification procedures.

View RFC 6376

2018

Ed25519 Support (RFC 8463)

RFC 8463 added Ed25519-SHA256 as an alternative signing algorithm, offering stronger security with smaller key sizes compared to traditional RSA keys.

View RFC 8463

2026

Universal Requirement

DKIM signing is now expected by all major email providers. Combined with SPF and DMARC, it forms the essential email authentication stack required for reliable deliverability.

Anatomy of a Signature

DKIM-Signature Header Tags

The DKIM-Signature header is added to every signed email and contains these key tags:

v=1

DKIM version (always 1)

Signing algorithm (rsa-sha256 or ed25519-sha256)

Base64-encoded digital signature

bh=

Body hash (canonicalized body content)

Canonicalization (simple/relaxed for header/body)

Signing domain (SDID)

List of signed header fields

Selector (locates the DNS key record)

t= / x=

Signature timestamp / expiration time

DNS Record Tags

The public credential is published as a DNS TXT record at selector._domainkey.example.com:

v=DKIM1

Record version (required)

Base64-encoded public key (required)

Key type (rsa or ed25519, default: rsa)

Acceptable hash algorithms

Flags (y=testing, s=strict domain match)

Notes (human-readable, not interpreted)

RSA vs Ed25519 Algorithms

RSA (rsa-sha256)

Universal support across all email providers
Minimum 1024-bit keys, 2048-bit recommended
Larger key sizes create longer DNS TXT records
Slower signing and verification than Ed25519

Ed25519 (ed25519-sha256)

Stronger security with much smaller keys (256-bit)
Faster signing and verification
Not yet supported by all email providers
Often deployed alongside RSA as a dual-signature setup

Why Your Domain Needs DKIM

Prove Authenticity

Cryptographically prove that emails genuinely originate from your domain, not an impersonator.

Prevent Tampering

Detect any modifications to email content made after the message was signed and sent.

Boost Deliverability

DKIM-signed emails are trusted more by receiving servers, improving inbox placement rates.

Enable DMARC

DKIM is one of two authentication methods required for DMARC alignment and policy enforcement.

Survive Forwarding

Unlike SPF, DKIM signatures survive email forwarding because they are embedded in the message itself.

Build Reputation

Consistent DKIM signing builds your domain's sender reputation with email providers over time.

Common Mistakes to Avoid

Weak or Short Keys

Using 512-bit or 1024-bit RSA keys is increasingly risky. Migrate to 2048-bit RSA keys for adequate security, or adopt Ed25519 for even stronger protection with smaller key sizes.

Leaving Testing Mode On

The t=y flag in DNS tells receivers the key is in testing mode, so DKIM failures are not enforced. Remove this flag once you have verified that signing works correctly.

No Key Rotation

Keeping the same DKIM key pair indefinitely increases the risk of compromise. Rotate keys periodically (e.g., every 6–12 months) by publishing a new key under a new selector before retiring the old one.

Wrong Canonicalization

Using simple/simple canonicalization causes DKIM failures when mail servers add or modify whitespace. Use relaxed/relaxed for maximum compatibility across different email infrastructure.

Implementation Steps

Generate Your Credentials

Generate a 2048-bit RSA pair (or Ed25519 if your provider supports it). Most email platforms like Google Workspace, Microsoft 365, and SendGrid handle generation automatically.

Publish the Public Record in DNS

Create a DNS TXT record at selector._domainkey.yourdomain.com containing your public value. The selector name is chosen by you (e.g., google, s1, 2026q1).

Enable Signing and Validate

Configure your mail server or provider to sign outgoing emails with the private key, then use our DKIM Checker to verify the DNS record is published correctly and the signature validates.

Combine with SPF and DMARC

DKIM works best alongside SPF and DMARC. Together, these protocols give receivers full confidence in your email authenticity and allow you to set enforcement policies.

Check Your DKIM Record

Use our free DKIM checker to validate your domain's DKIM configuration and ensure your emails are properly signed.

Check DKIM Record Check DMARC

Check SPF Create DMARC Record