Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

DKIM

DomainKeys Identified Mail: a cryptographic signature added to outgoing messages and verified against a public key published in the sending domain's DNS. Defined in RFC 6376.

Sumit Raj · reviewed

DomainKeys Identified Mail. A signature proving a message was sent by somebody holding the private key, and that it has not been altered in transit.

The public key lives at <selector>._domainkey.<domain>. The selector is a label allowing one domain to publish several keys, which is how providers rotate them without downtime.

DKIM’s practical advantage over SPF is that it survives forwarding. When a mailing list relays a message the sending IP changes and SPF breaks; the signature travels with the message and still verifies.

An empty p= in the key record is not a broken record. RFC 6376 section 3.6.1 defines it as an explicit revocation, and every signature made with that key must be treated as failing.

Related

  • SPFSender Policy Framework: a DNS TXT record listing the servers authorised to send mail using a domain in the SMTP envelope sender. Defined in RFC 7208.
  • DMARCDomain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.
  • DMARC alignmentThe DMARC requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header, either exactly (strict) or allowing subdomains (relaxed). Defined in RFC 9989 section 4.4.
  • What is DKIM?A cryptographic signature on every message you send, and the only identifier that survives being forwarded.
  • DKIM TestSelector discovery and the real key length, read from the published key.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.