Glossary
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication standard that adds a cryptographic signature to each message. The receiving server fetches the public key from the sender's DNS and checks that the signed headers and body were not changed.
What Is DKIM (DomainKeys Identified Mail)?
In short The sending server signs selected headers and the body with a private key and adds a DKIM-Signature header.
That header names the signing domain (d=) and a selector (s=). The receiver looks up the public key in a TXT record at selector._domainkey.domain, checks the signature and records pass or fail.
DKIM proves that a server controlled by the signing domain sent the message and that nobody changed it on the way. Unlike SPF, the signature usually survives forwarding, because it travels with the message instead of depending on the sending IP. It breaks when a forwarder changes the message, as many mailing lists do. That makes DKIM the steadier half of DMARC.
DKIM Example
Example: a team adds a new sending tool, which gives it a public key to publish as a TXT record at s2026._domainkey.example.com. A test message to Gmail then shows dkim=pass with header.d=example.com, and the key for its main mailbox provider keeps working under a different selector.
DKIM in Practice
RFC 8301 requires signers to use RSA keys of at least 1024 bits and says they should use at least 2048. Give each sending service its own selector, so you can rotate or revoke one key without breaking the others.
FAQ
What is DKIM?
An email authentication standard that signs each message with a private key. Receivers check the signature against a public key published in the sender's DNS, which proves the signing domain sent it and the content was not altered.
What is a DKIM selector?
The s= value in the DKIM-Signature header. It tells the receiver where to find the public key: in a TXT record at selector._domainkey.example.com. Selectors let one domain hold several keys, one per sending service.
What DKIM key length should I use?
2048-bit RSA. RFC 8301 requires at least 1024 bits and recommends 2048, and RSA with SHA-1 must no longer be used. Google requires at least 1024 bits for mail to personal Gmail accounts and recommends 2048.
Is DKIM enough to pass DMARC?
It can be. DMARC passes when SPF or DKIM passes for a domain aligned with the From address. DKIM is the more reliable of the two because it usually survives forwarding, but publish SPF too, since Google requires both from bulk senders.
Does DKIM encrypt email?
No. DKIM signs a message so receivers can verify who sent it and that it was not changed. The content stays readable. TLS is what encrypts mail between servers.
Do This in Ken
Do This in Ken
Delivery handles DNS setup for the sending domains it provisions and checks DKIM on each one, with a pass or fail you can see before a campaign starts.
- Module
- Delivery
- Open in Ken
- /features
The new Ken opens to the waiting list in batches.
Related
- GTM Glossary
Every GTM term, grouped by topic.
- SPF (Sender Policy Framework)
- DMARC
- CNAME record
- BIMI
- Sender reputation
- Ken
Sources
| Source | Checked |
|---|---|
| RFC 6376: DomainKeys Identified Mail (DKIM) Signatures | |
| RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM | |
| Google: Email sender guidelines |
Changelog
- Page published.