What Is DKIM? How DomainKeys Identified Mail Signs and Protects Your Email
A DKIM pass does not prove an email came from who it says. So what is DKIM? DomainKeys Identified Mail adds a digital signature to outgoing email, which receivers check against a public key in your DNS to confirm the message was authorized by a domain and not changed in transit. Which domain is the catch.
What Is DKIM?
DKIM is an email authentication standard that lets a domain take responsibility for a message by signing it with a private key. The receiving server fetches the matching public key from the sender’s DNS and verifies the signature. A valid signature shows the signing domain approved the message and that the signed parts were not altered.
What Does DKIM Stand For?
DKIM stands for DomainKeys Identified Mail. It merged two earlier efforts, Yahoo’s DomainKeys and Cisco’s Identified Internet Mail. The current standard is RFC 6376 (2011), published by the Internet Engineering Task Force (IETF).
Why DKIM Matters for Business Email
DKIM is now a delivery requirement, not an extra. Since February 2024, Google and Yahoo require SPF, DKIM and DMARC from senders of more than 5,000 messages a day to their users, and Microsoft applied similar rules to Outlook.com in May 2025. DKIM is also what lets DMARC survive forwarding, which breaks SPF.
How Does DKIM Work?
Signing Outbound Email With a Private Key
Your mail server or provider hashes selected headers and the message body, then signs the hash with a private key only it holds. The result goes into a DKIM-Signature header.
Verifying the Signature With the Public Key in DNS
The receiving server reads the domain (d=) and selector (s=) from the header, looks up the public key at selector._domainkey.domain, then checks the signature and the body hash. If anything signed changed, the check fails.
What Is a DKIM Signature?
A DKIM signature is the header added to each signed message. A simplified example:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; h=from:to:subject:date; bh=…; b=…
DKIM-Signature Header Tags Explained
- v: version, always 1
- a: algorithm, such as rsa-sha256
- d: the signing domain that takes responsibility
- s: the selector used to find the public key
- h: the list of signed headers
- bh: hash of the message body
- b: the signature itself
What Is a DKIM Record?
A DKIM record is a DNS entry that publishes the public key receivers use to verify your signatures. It sits at a name built from the selector, such as selector1._domainkey.example.com, and contains the key type and the key itself.
DKIM Record Example
selector1._domainkey.example.com TXT “v=DKIM1; k=rsa; p=MIIBIjANBgkq…”
The p= value is the public key. An empty p= means the key has been revoked.
TXT vs CNAME DKIM Records
The key itself always ends up in a TXT record. Many providers, including Microsoft 365, ask you to publish a CNAME instead, which points to a TXT record they host. That lets the provider rotate keys without you editing DNS.
What Is a DKIM Selector?
A selector is a label that tells receivers which key to use, because one domain can have many. Find it in the s= tag of any signed message’s headers. Microsoft 365 uses selector1 and selector2, and Google Workspace uses “google” by default. Use a separate selector for each sending service, so you can revoke one without touching the others.
The Contrarian Truth: Why DKIM Alone Does Not Stop Spoofing
This is the point that matters most. DKIM proves that some domain signed the message. It does not require that domain to match the From address your staff see.
An attacker can register a look-alike domain, set up DKIM correctly and send mail that passes DKIM perfectly while showing your company name in the From field. A receiving server that checks only “is the DKIM signature valid?” will accept it.
What Is DKIM Alignment?
Alignment is the fix, and it comes from DMARC (RFC 7489, 2015). DMARC passes only when the DKIM signing domain (d=) matches the visible From domain, or the SPF domain matches it. Relaxed alignment allows subdomains. Strict alignment requires an exact match.
DKIM vs SPF vs DMARC
| DKIM | SPF | DMARC | |
|---|---|---|---|
| Checks | A cryptographic signature from a domain | Whether the sending IP is authorized | That SPF or DKIM passes and aligns with the From domain |
| Survives forwarding | Usually | No | Yes, if DKIM aligns |
| Tells receivers what to do on failure | No | Limited | Yes: none, quarantine or reject |
A decision rule follows: treat DKIM as done only when every service that sends as your domain signs with d= set to your domain, and DMARC reports confirm it.
What DKIM Does Not Do
DKIM Is Not Encryption
DKIM signs messages. It does not hide their content. Use TLS for transport and S/MIME or another encryption method for confidentiality.
Forwarding, Mailing Lists and ARC
Mailing lists often add footers or change subjects, which breaks the body hash or signed headers. Authenticated Received Chain (ARC, RFC 8617, 2019) lets intermediaries record the authentication results they saw, so receivers can choose to trust them.
How to Set Up DKIM
DKIM in Microsoft 365
In the Microsoft Defender portal, open the email authentication settings, select your domain, publish the two CNAME records it shows (selector1 and selector2) and enable signing.
DKIM in Google Workspace
In the Admin console, go to Gmail authentication, generate a 2048-bit key, publish the TXT record at google._domainkey and start authentication.
DKIM for Third-Party Senders (CRM, Newsletters, Helpdesk)
Each service that sends as your domain needs its own selector and record, so its d= matches your domain. Without it, the service may sign with its own domain, which fails DMARC alignment.
DKIM Best Practices: Key Length and Rotation
RFC 8301 (2018) says signers must use RSA keys of at least 1024 bits, should use 2048 bits, and must not sign with SHA-1. Use 2048-bit keys where your DNS host supports the longer record. Rotate keys on a schedule and when a provider or staff member with access leaves. Publish the new selector first, switch signing and remove the old key after mail in transit has cleared.
How to Check and Troubleshoot DKIM
Open a message’s full headers and look for “dkim=pass” with your domain in the Authentication-Results line. Common failures are a missing or mistyped DNS record, a key split badly across TXT strings, a gateway that changes messages after signing, and a third-party sender signing with its own domain. DMARC aggregate reports show which sources fail.
What Is DKIM Doing for You? Your DKIM Checklist
What is DKIM worth on its own? Some protection, but its real value comes with alignment. Work through this list:
- List every service that sends as your domain
- Give each its own selector, signing with your domain in d=
- Use 2048-bit keys and set a rotation schedule
- Publish DMARC at p=none, read the reports, then move toward reject
If you would like help working through it, Cyber Security Solutions Ltd offers a free email security assessment through our contact page.
FAQs
Yes, for any business that sends email. Google and Yahoo require SPF, DKIM and DMARC from bulk senders, and Microsoft applies similar rules to Outlook.com. DKIM also lets DMARC pass after forwarding, where SPF usually fails. Without it, your mail is more likely to be filtered, and spoofing your domain is easier.
Yes, as long as each uses a different selector. A domain commonly has one selector for Microsoft 365 or Google Workspace and others for a CRM, newsletter or helpdesk tool. Each record lives at its own selector._domainkey name. Do not publish two different keys under the same selector, because receivers cannot tell which to use.
The public key is always stored in a TXT record. Some providers, including Microsoft 365, ask you to publish a CNAME that points to a TXT record they host, so they can rotate keys without changes on your side. Follow your provider's instructions and confirm the final lookup returns a valid key.
It helps. Major mailbox providers use DKIM to build domain reputation and, since 2024, require it for bulk senders. A valid, aligned DKIM signature makes it more likely your mail reaches the inbox. It does not guarantee delivery, because content, complaint rates and sending history also affect filtering decisions.
Not on its own. DKIM proves a domain signed the message, but attackers can sign mail from look-alike domains they own. DMARC with an enforcement policy stops others sending as your exact domain. Staff training and filtering are still needed for look-alike domains and compromised accounts.
A DKIM fail means the receiver could not verify the signature. Common causes are a missing or wrong DNS record, a message changed after signing by a gateway or mailing list, or an expired or rotated key. Check the Authentication-Results header for the reason, then fix the record or the system altering mail.
