DKIM (DomainKeys Identified Mail)
DKIM is an email authentication method that allows the sending domain to cryptographically sign outgoing messages. Receiving mail servers verify the DKIM signature against a public key published in DNS to confirm the email was not altered in transit and originates from an authorized sender.
Key Aspects
Cryptographic Signing
Uses public-key cryptography to sign email headers and body, proving message integrity.
Spoofing Prevention
Helps receiving servers verify that the email genuinely came from the claimed domain.
DNS-Based Verification
Public keys are published as DNS TXT records, allowing any receiver to verify signatures.
Deliverability Boost
Emails with valid DKIM signatures are less likely to be flagged as spam.
How DKIM Works
Generate Key Pair
The sending domain generates a public/private key pair. The private key is stored on the mail server; the public key is published in DNS.
Sign Outgoing Email
When an email is sent, the mail server creates a hash of specified headers and the body, then encrypts it with the private key to produce the DKIM signature.
Attach Signature Header
The DKIM signature is added as a DKIM-Signature header to the email before it leaves the sending server.
Receiver Verifies
The receiving mail server retrieves the public key from DNS, decrypts the signature, and compares the hash to verify the email was not tampered with.