What Is DKIM?
DKIM stands for DomainKeys Identified Mail. It is an email authentication standard that allows the sending domain to attach a cryptographic signature to outgoing messages. The receiving mail server can then verify the signature using a public key published in the sender's DNS, confirming that the message has not been modified in transit and that it was authorized by the domain owner.
How DKIM works
When a mail server sends an email with DKIM enabled, it performs these steps:
- The server selects which headers and body content to sign.
- It generates a hash of the selected content and signs it with a private key.
- The signature is added to the email as a
DKIM-Signatureheader, which includes the selector name, signing domain, algorithm, and the signature itself.
When the receiving server gets the email, it:
- Reads the
DKIM-Signatureheader to find the selector and domain. - Queries DNS for the public key at
selector._domainkey.example.com. - Uses the public key to verify the signature against the message content.
- If the signature is valid, the message passes DKIM authentication.
What is a DKIM selector?
A DKIM selector is a short label that tells the receiving server which public key to look up. Since a domain can have multiple DKIM keys (for different mail systems, key rotation, or testing), the selector makes it possible to use more than one key at a time.
Common selector names include google, selector1, s1, k1, and default. The selector name is arbitrary and chosen by the domain administrator when configuring DKIM.
The DKIM DNS record
A DKIM public key is published as a TXT record at selector._domainkey.example.com. The record value typically includes:
v=DKIM1— the DKIM versionk=rsa— the key type (RSA is most common)p=...— the base64-encoded public key
If the p= field is empty, it means the key has been revoked, which is used during key rotation to signal that the old selector should no longer pass verification.
DKIM vs SPF vs DMARC
| Standard | What it checks | DNS record type |
|---|---|---|
| SPF | Whether the sending server IP is authorized | TXT at domain root |
| DKIM | Whether the message was signed and unaltered | TXT at selector._domainkey |
| DMARC | Policy for handling SPF/DKIM failures | TXT at _dmarc |
SPF, DKIM, and DMARC work together. SPF validates the sending server. DKIM validates the message content. DMARC ties them together with a domain-level policy and alignment rules. For the strongest email authentication, all three should be configured.
Common DKIM problems
- Missing DNS record: the selector TXT record does not exist or has a typo in the domain name.
- Key mismatch: the private key used to sign does not match the public key in DNS, often after a key rotation mistake.
- Body modification: mailing lists, forwarding services, or security gateways may alter the message body, breaking the DKIM signature.
- Selector confusion: using the wrong selector name when troubleshooting or configuring a third-party email service.
Frequently asked questions
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. The receiving server uses a public key published in DNS to verify that the message content has not been tampered with.
What is a DKIM selector?
A DKIM selector is a label used to locate the correct public key in DNS. The selector appears in the DKIM-Signature header of the email, and the receiving server queries selector._domainkey.example.com to find the matching TXT record.
How is DKIM different from SPF?
SPF checks whether the sending server's IP is authorized by the domain's DNS. DKIM checks whether the message content was signed by the domain and has not been altered. They address different attack vectors and are both used alongside DMARC.
Does DKIM encrypt email?
No. DKIM does not encrypt the message content. It only signs headers and body content so the recipient can verify integrity. Email encryption requires separate mechanisms like TLS or S/MIME.
How do I check if DKIM is set up for a domain?
You need to know the selector name. Then query selector._domainkey.example.com for a TXT record. IPLookupHub's DKIM Checker tool can help you look up DKIM records by domain and selector.