Skip to content
mailprompt
Start free trial
GlossaryUpdated

What is DKIM?

DKIM is an email authentication method that adds a cryptographic signature to a message. The sending domain publishes a public key in DNS, and the receiving server uses it to verify the signature and the body. A valid signature shows that the domain authorized the message and that it was not changed in transit.

Key facts

  • RFC 6376 defines DomainKeys Identified Mail and the signature header it adds to messages. Source
  • Google asks bulk senders to authenticate with DKIM as part of its sender guidelines. Source
  • DMARC uses DKIM alignment with the From domain as one of the ways a message can pass. Source

What DKIM is

This definition is part of the Mailprompt glossary. DKIM stands for DomainKeys Identified Mail. It is an authentication method that adds a digital signature to an email message.

The sending domain publishes a public key in DNS. The sending system signs the message with the matching private key. The receiving server fetches the public key and checks the signature. If the signature is valid, the receiver knows that the domain authorized the message and that the signed parts were not changed in transit.

What the signature covers

A DKIM signature covers selected headers and the body. The signer chooses which parts to sign. A message can be signed by a third-party domain on behalf of the brand, which is why alignment with the From domain matters.

The signature is added as a header. The header names the signing domain, the selector and the algorithm. The receiver uses those fields to find the public key.

Selectors and keys

A selector is a label that points at a specific key. The DNS name is usually the selector followed by ._domainkey. A domain can publish several selectors, which allows key rotation without breaking mail that is already in flight.

When a sender rotates a key, it publishes the new key at a new selector and starts signing with it. The old selector can remain for a while, then be removed. A key that is removed too early can break messages that were signed before the change.

DKIM and forwarding

SPF is evaluated against the envelope sender, which forwarding can change. DKIM is evaluated against the signature, which can survive some forwarding paths. That is one reason DKIM matters for deliverability even when SPF is already in place.

Forwarding can still break a signature if the forwarder changes the body or the signed headers. A mailing list that adds a footer, for example, can invalidate the original signature. DMARC alignment gives the receiver another way to evaluate the message.

What DKIM does not do

DKIM does not encrypt the message. It does not prove that the content is true or that the sender is a good actor. It proves that a domain signed the message and that the signed content was not changed.

A valid DKIM signature from a domain that sends spam is still a valid signature. Authentication is about identity and integrity, not reputation or consent.

  • SPF authorizes the sending servers.
  • DMARC ties authentication to a policy.
  • Deliverability is the outcome the signature supports.

Frequently asked questions

What is the difference between DKIM and SPF?

SPF authorizes the servers that may send for a domain, based on the envelope sender. DKIM signs the message and can survive forwarding better than SPF. DMARC can pass if either SPF or DKIM aligns with the From domain, which is why both matter.

What is a DKIM selector?

A selector is the label that tells the receiver which public key to fetch. The selector is part of the DNS name, usually something like a vendor label followed by ._domainkey. The sender must use the same selector in the signature that the domain published in DNS.

Does DKIM encrypt the email?

No. DKIM signs the message; it does not encrypt it. Anyone who can read the message can still read it. Encryption in transit is a separate mechanism, such as TLS between mail servers. DKIM protects integrity and domain authorization, not confidentiality.

Sources