What is DKIM? Email signatures explained

What DKIM does

DKIM (DomainKeys Identified Mail) lets a sending domain sign each message with a private key. The matching public key is published in DNS. A receiving server fetches the key, checks the signature, and learns two things: the message was signed by that domain, and the signed parts were not changed on the way.

The standard is RFC 6376, published in 2011. Unlike SPF, DKIM does not care which server delivered the message, so a valid signature usually survives forwarding.

Your mail provider or sending service does the signing for you. A domain owner usually only needs to publish the public key the provider gives them, either as a TXT record or as a CNAME that points to a key the provider manages.

What a DKIM signature looks like

The sending server adds a DKIM-Signature header to the message. The signature values are long base64 strings, shortened here:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=example.com; s=s1; t=1760450000;
        h=from:to:subject:date:message-id;
        bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
        b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVFOk4yAUoqOB...

Reading the tags

d= is the signing domain, here example.com. s= is the selector, a name that tells the receiver which key to look up. a= is the algorithm, usually rsa-sha256 (ed25519-sha256 is also defined). h= lists the headers covered by the signature, and From must always be one of them. bh= is a hash of the message body, and b= is the signature itself. c= sets how strictly whitespace and header case are compared, since servers along the way sometimes reformat them.

The receiver combines the selector and domain to find the public key. For s=s1 and d=example.com, it looks up a TXT record at s1._domainkey.example.com:

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx..."

Selectors, rotation and limits

Selectors let one domain use several keys at once. A company might sign with selector google for Google Workspace and a different selector for its newsletter tool, each with its own key. To rotate a key, the domain publishes a new selector, switches signing to it, and later removes the old one. Keys of at least 1024 bits are required, and 2048 bits is the common choice today.

DKIM on its own proves only that some domain signed the message. A scammer can sign mail with their own domain and pass DKIM. DMARC is what connects the signing domain to the From address you see.

Signatures break if a signed part changes. Mailing lists that add a footer to the body or a tag to the subject are the usual cause.