DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails that receiving servers can verify. This proves the email hasn't been tampered with in transit and confirms the sender's identity.
How it works
- Your email server signs each outgoing email with a private key.
- The corresponding public key is published as a DNS TXT record at
selector._domainkey.yourdomain.com. - The receiving server looks up the public key using the selector from the email's DKIM header and verifies the signature.
Key components
Selector
An identifier for the key pair (e.g. google, s1, dkim). A domain can have multiple selectors for different sending sources. Each sending service typically uses its own selector.
Algorithm
RSA with SHA-256 hashing is the recommended algorithm. Minimum key length is 2048 bits - shorter keys (e.g. 1024-bit) are considered weak and may not be trusted by receivers.
The d= tag
The signing domain in the DKIM-Signature header. This is the domain that claims responsibility for the email. It must align with the From header domain for DMARC to pass on DKIM.
The t=y flag
Testing mode. When set, receiving servers may not enforce DKIM failures. Remove this flag after confirming that signing works correctly.
DKIM alignment with DMARC
The d= domain in the DKIM signature must match the From header domain:
- Relaxed (
adkim=r) - Organizational domain match.mail.example.comaligns withexample.com. - Strict (
adkim=s) - Exact domain match only.
See DMARC alignment for more details.
