What is DKIM?
Also known as: DomainKeys Identified Mail
DKIM is an email authentication method that lets a domain claim responsibility for a message by attaching a cryptographic signature validated against a DNS public key.
DomainKeys Identified Mail (DKIM) is an email authentication standard defined in RFC 6376. It allows an organization to take responsibility for a message by adding a digital signature to the email headers. The signature covers specified parts of the message, including the body and key headers, and is created using a private key held by the sender's mail infrastructure. The corresponding public key is published as a DNS TXT record under a domain in the message header (commonly the d= tag domain). A receiving mail server can retrieve the public key via DNS lookup, verify the signature, and thus confirm that the message was not modified in transit and indeed originated from or was authorized by the signing domain.
DKIM operates as an enhancement to SMTP, not a replacement for existing security. It does not encrypt message content and does not prevent forgery of the From address by itself. DKIM is most effective when combined with SPF and DMARC. DMARC uses DKIM results to enforce policy, allowing a domain owner to tell receivers how to handle messages that fail authentication. DKIM keys are typically rotated regularly, and the signature is added by the outgoing mail server (or a boundary MTA) rather than by the end user's mail client. The selector field in the DKIM header (s= tag) allows a domain to publish multiple keys simultaneously, supporting key rollovers and different signing practices for different senders.
Deployment of DKIM requires DNS administration to create and update public-key records and mail-server configuration to sign outgoing mail. The standard is widely used by email providers, mailing-list software, and transactional email services. Verification of DKIM signatures occurs early in the receiving mail-processing pipeline, often before content filtering. A successful DKIM verification does not guarantee that the message is legitimate (the signing domain could be compromised), but it provides a strong signal that the message was not tampered with and aligns with domain-based reputation systems.
Key facts
- Defined in RFC 6376, updated from RFC 4871 and RFC 5672.
- Uses asymmetric cryptography: sender signs with private key, receiver verifies with public DNS TXT record.
- DKIM signature is carried in the DKIM-Signature header field with tags like v=, a=, d=, s=, b=.
- Does not encrypt email content; only provides integrity and origin authentication.
- Selector mechanism (s= tag) allows multiple keys per domain for different senders or key rollovers.
How it works in practice
Related terms
References
More in Email
BIMI
BIMI (Brand Indicators for Message Identification) is a DMARC-aligned standard that lets email senders publish a verified logo for display in supporting mail clients.
Bounce Message
A bounce message, or non-delivery report (NDR), is an automated email sent to the originator when delivery cannot be completed, including a status code and failure reason.
Catch-All Email
A catch-all email account receives all messages sent to invalid or nonexistent addresses at a domain, preventing bounce-backs but attracting spam.
DMARC
DMARC is an email authentication policy protocol that builds on SPF and DKIM to tell receiving mail servers how to handle messages that fail authentication checks.
DNSBL
A DNSBL is a real-time IP reputation database published via DNS, used by mail servers at SMTP time to reject or flag senders known for spam or abuse.
Greylisting
Greylisting is a spam-filtering technique that temporarily rejects email from unknown senders, forcing legitimate mail servers to retry delivery while filtering out spammers that do not retry.
IMAP
IMAP is an email protocol that lets clients access and manage messages stored on a mail server, keeping the server as the authoritative copy and synchronizing folder state across multiple devices.
Mailbox Quota
A mailbox quota is a storage limit placed on a user's email account. Once the total size of stored messages exceeds this limit, the server may reject new incoming emails or warn the user.
MDA
An MDA (Mail Delivery Agent) is a software component that transfers an email from a Mail Transfer Agent (MTA) into a recipient's local mailbox, typically on a mail server or a user's machine.
MTA
An MTA (Mail Transfer Agent) is server software that routes email between domains using the SMTP protocol, acting as the core delivery engine for internet email.