DKIM (DomainKeys Identified Mail)

DomainKeys Identified Mail (DKIM), defined in RFC 6376, lets a sending domain sign outgoing messages with a private key. Receivers fetch the matching public key from DNS and verify the signature. A valid signature shows that a specific domain took responsibility for the message and that the signed parts were not changed on the way.

How it works

The sending server computes a hash of selected headers, such as From, Subject and Date, and of the message body, then signs it with the private key. It adds a DKIM-Signature header that names the signing domain (d=) and a selector (s=). The public key is published in DNS at selector._domainkey.example.com, so a domain can have several keys for different services and rotate them. Unlike SPF, DKIM usually survives forwarding as long as the message is not modified, although mailing lists that add footers or change subjects can break it. DKIM alone does not tell receivers what to do when a signature fails, and the d= domain does not have to match the From address. DMARC adds both a policy and the requirement that the signing domain align with the visible sender.

Example

An illustrative case: a fictional company sends customer emails through a CRM platform. Until the platform is set up to sign with the company's own domain, its messages carry a signature for the platform's domain instead. That signature does not align with the company's From address, so DMARC has to rely on SPF alone, and some of these legitimate messages fail.

How to spot problems

• Mail from a legitimate service is signed with the provider's domain, not yours.
• Headers or DMARC reports show dkim=fail, often after messages pass through lists or gateways that alter them.
• Old selectors with short keys are still published in DNS.
• Messages claiming to be from your domain arrive with no DKIM signature at all.

What brands can do

• Turn on DKIM signing with your own domain in every service that sends mail for you.
• Use 2048-bit keys where your providers support them, rotate keys on a schedule and remove unused selectors.
• Watch DMARC reports for sources that fail or do not sign.
• Combine DKIM with SPF and an enforced DMARC policy.

DKIM proves who signed a message, but it cannot stop a criminal from signing mail for a lookalike domain they own. Phishvoid finds and takes down such domains; contact the team for more. Setup guidance: SPF, DKIM and DMARC against email spoofing.

Read more: SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name