Email authentication

What is DKIM? DomainKeys Identified Mail explained

DKIM cryptographically signs outgoing email. Receivers verify the signature with a public key from DNS and so detect forged or altered messages.

How DKIM works

The sending mail server computes a signature over selected headers and the body of every message and adds it as a "DKIM-Signature" header. It contains, among other things, the signing domain (d=) and the selector (s=).

The public key is published as a TXT record at <selector>._domainkey.<domain>. The receiver fetches it and verifies the signature. If it matches, the message demonstrably comes from a server holding the private key and was not changed in transit.

Selectors can be chosen freely so that several services can use their own keys (e.g. "selector1" for Microsoft 365, "google" for Google Workspace). Because selectors cannot be listed from DNS, the Domain Trust Check tries about 150 common names; you can find your own in the DKIM-Signature header of a sent message (s=…).

Example

selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"

RSA keys should be 2048 bits long. Long keys are split into several strings of up to 255 characters in DNS.

Common mistakes

Test mode "t=y" stays on permanently after the rollout.
After switching providers nobody signs any more, or the old key stays published.
The key was truncated while copying or broken by stray spaces.
A provider signs with its own domain instead of yours – DMARC alignment is then missing.

How the Domain Trust Check rates DKIM

Criterion “DKIM” (weight 5 of 5): Looks for public DKIM keys at <selector>._domainkey across about 150 common selectors (custom selector optional) and checks for test mode (t=y) and revoked keys.

Standard: RFC 6376