What is DKIM? DomainKeys Identified Mail explained

DKIM (DomainKeys Identified Mail) is an email authentication standard that attaches a cryptographic signature to every outgoing message. The sending server signs selected headers and the body with a private key; the receiving server fetches the matching public key from the sender's DNS and verifies the signature. A valid signature proves two things at once: the message was authorized by the domain that signed it, and the signed content was not altered in transit. DKIM is defined in RFC 6376 and is one of the three core authentication mechanisms alongside SPF and DMARC.

What DKIM adds that SPF cannot

Where SPF authorizes sending servers by IP address, DKIM travels inside the message itself. That difference has a large consequence: a DKIM signature survives forwarding. A message relayed through a university alias or a corporate forwarding rule arrives from an IP the original sender never authorized, failing SPF, while the signature inside it still validates. DKIM also proves integrity: because the signature covers the body and key headers, any modification in transit breaks it, which no IP-based check can offer.

How signing and verification work

The DKIM round trip

1
The sender generates a key pair
The private key stays on the sending infrastructure; the public key is published as a DNS TXT record under a chosen selector name.
2
Outgoing mail gets signed
The sending server computes a hash of the body (bh=) and signs it together with selected headers, attaching the result as the DKIM-Signature header with the domain (d=) and selector (s=) identifying the key.
3
The receiver fetches the public key
It reads d= and s= from the signature and queries DNS at selector._domainkey.domain, for example s2026a._domainkey.example.com.
4
The signature is verified
The receiver recomputes the hashes and checks the signature against the public key. A match yields dkim=pass; a mismatch, a missing key, or altered content yields fail or an error.
5
DMARC consumes the result
If the signing d= domain aligns with the From: domain, the pass counts toward DMARC, which is where DKIM becomes an anti-spoofing control rather than just an integrity check.

The parts of DKIM

Each piece has its own entry. The DNS record and selectors cover how public keys are published and why selectors allow multiple keys per domain. The DKIM-Signature header entry decodes every tag in the signature itself. Key management and rotation covers key sizes, rotation practice, and vendor delegation. Canonicalization explains how messages are normalized before signing and why signatures break in transit. And the security hardening entry covers oversigning, the l= tag, and replay abuse.

DKIM in the DMARC era

On its own, DKIM proves that some domain signed the message; nothing requires that domain to match what the recipient sees in the From: header. DMARC adds that requirement through alignment, and in that combination DKIM is usually the mechanism that carries the pass: it survives forwarding, it is unaffected by SPF's lookup limits, and ESPs support signing with the customer's own domain. The practical rule for senders: every mail stream signs with an aligned d= domain, no exceptions, and SPF serves as the second witness.

The compliance landscape assumes this posture. The Gmail and Yahoo bulk sender requirements of 2024 and Microsoft's 2025 Outlook requirements all demand DKIM signing from high-volume senders, with 2048-bit keys as the recommended strength, and DKIM failures already cost inbox placement at every major provider regardless of volume.

A passing DKIM verification in Authentication-Results

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=s2026a header.b=K9dQ2mXe;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

Frequently asked questions

Does DKIM encrypt my email?

No. DKIM signs, it does not encrypt: message content remains readable to anyone handling it. The signature proves origin and integrity. Confidentiality in transit comes from TLS between servers, a separate layer.

Can a message carry multiple DKIM signatures?

Yes, and it is common: an ESP may sign with its own domain while also signing with the customer's domain. Receivers evaluate each signature independently, and DMARC needs only one aligned pass among them.

Do I need DKIM if SPF already passes?

Yes. SPF breaks on forwarding and validates a domain most recipients never see. DKIM is the mechanism that keeps DMARC passing across real-world delivery paths, and provider rules ask for both.

Who signs my mail in practice?

Whatever operates your outbound path: your ESP or transactional provider (configured with your domain and keys via their dashboard), or your own MTA with a signing filter such as OpenDKIM or Rspamd for self-hosted setups.

Key takeaways

DKIM signs messages with a private key and publishes the public key in DNS under a selector
A valid signature proves the signing domain authorized the message and the content was not altered
Signatures travel inside the message and survive forwarding, which SPF cannot do
DKIM becomes anti-spoofing protection only through DMARC alignment of the d= domain with the From: domain
Every major provider now expects DKIM from bulk senders, with 2048-bit keys as the standard