What DKIM tag allows for a specific query method?

The specific DKIM tag that allows for a query method is the q= tag. This tag is part of the DKIM signature found in an email's headers and plays a role in the email authentication process. While it's a fundamental part of the DKIM specification, it is an optional tag that you won't always see in every DKIM signature.

Essentially, DomainKeys Identified Mail (DKIM) is a protocol that allows an organization to take responsibility for transmitting a message in a way that can be verified by mailbox providers. This verification is done using cryptographic authentication, and the q= tag helps define how a part of that verification is performed.

Suped DMARC monitor

Free forever, no credit card required

Get started for free

Trusted by teams securing millions of inboxes

The primary role of the q= tag is to specify the query method(s) that a receiving mail server should use to retrieve the public key from the DNS. This public key is the crucial component needed to verify the email's signature.

DuoCircle says:

Visit website

'q' tag (optional) ... It stands for the 'query method' tag and defines the method used to retrieve the public key. Typically, this is dns/txt.

The most common, and effectively the only used, value for this tag is dns/txt. This instructs the server to perform a standard TXT record lookup in the DNS to find the DKIM public key. Because this is the default method, the q= tag is often omitted from DKIM signatures altogether; its presence is implied. The specification does allow for a list of query methods, should others be developed in the future.

Search Security says:

Visit website

This tag can be used to include a comma-separated list of query methods that can be used to retrieve the sending email server's public key.

The q= tag is just one of many that make up a complete DKIM signature. To understand its place, it helps to know some of the other key tags found in the DKIM-Signature email header:

• v=: The version of DKIM being used. This is almost always 1.
• a=: The cryptographic algorithm used to generate the signature. A common value is rsa-sha256.
• d=: The domain that is signing the email. This is the domain the receiving server will check for the public key.
• s=: The selector. This is a specific string used to help locate the correct public key in the DNS, especially if a domain has multiple DKIM keys.
• h=: The list of headers that have been included in the cryptographic signature.
• b=: The actual signature data for the headers listed in the h= tag.
• bh=: The hash of the email's body.

When a mail server receives an email, it reads the d= (domain) and s= (selector) tags from the DKIM signature. It combines them to form a DNS query, for example: selector._domainkey.example.com. The server then performs a query, following the method specified by the q= tag (or the default dns/txt). The result of this query is the DKIM record, which contains the public key in its own p= tag. This public key is then used to validate the signature (b=) in the email header.

So, while the q= tag is the direct answer, its function is best understood as one small, but important, step in the overall DKIM verification process. It provides the instructions for how to find the key needed to unlock and verify an email's authenticity.