What is DKIM?

DKIM stands for DomainKeys Identified Mail.

It works by attaching a digital signature to every outgoing email. The recipient’s mail server uses your public key (stored in your DNS) to check that the email is authentic and unchanged.

In simple words: SPF checks who is allowed to send; DKIM checks the message itself is legit.

Why DKIM Matters

Ensures authenticity → proves the email wasn’t modified in transit.
Builds trust with ISPs → Gmail, Outlook, and Yahoo strongly rely on DKIM.
Improves deliverability → signed emails are less likely to go to spam.
Required for DMARC → DMARC policies only work when SPF or DKIM are properly configured.

How DKIM Works (Step by Step)

Your mail server generates a private key and uses it to sign outgoing emails.
You publish the corresponding public key in your DNS as a TXT record.
When the recipient’s server gets the email, it:

- Finds your DKIM public key in DNS.

- Uses it to verify the signature in the email header.

- Confirms the email hasn’t been tampered with.

Example DKIM Record

A DNS TXT record might look like this:

default._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

Explanation

default._domainkey.example.com

This is the selector + domain used for DKIM.
default → the selector (you can have multiple selectors, e.g. for rotating keys).
_domainkey → required label that indicates this is a DKIM record.
example.com → your domain name.

Together, they tell mail servers where to look in DNS for the DKIM public key.

IN TXT

Means this is a TXT record in DNS.
DKIM uses TXT records to publish the public key.

"v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

This is the value of the record, containing the DKIM settings:
v=DKIM1 → version (always DKIM1).
k=rsa → key type (RSA is the most common).
p=... → the public key itself, base64 encoded. This is what receiving mail servers use to verify the signature in your emails.

Common Mistakes with DKIM

Forgetting to add the DNS record for your DKIM selector.
Using expired or mismatched keys.
Not rotating keys → old keys can be compromised.
Sending emails via a third-party service without enabling DKIM signing.

🥋 Sensei Tip

DKIM is like putting your signature on every letter you send. Without it, anyone can forge your name. With it, your recipients know for sure it’s really you and that nothing was changed along the way.

What is DKIM? (DomainKeys Identified Mail)

What You'll Learn