DKIM Records Explained
What is DKIM? DomainKeys Identified Mail (DKIM) is an authentication standard used to prevent email spoofing. DKIM attempts to prevent the spoofing of a domain that’s used to deliver email. DKIM employs the concept of a domain owner who controls the DNS records for a domain. When sending email with DKIM enabled, the sending server signs the
1 April 2022 2 min read
This is the technical reference for how DKIM works under the hood – if you want the practical guide to setting it up and testing it, see How to Use DKIM to Prevent Domain Spoofing.
What is DKIM?
DomainKeys Identified Mail (DKIM) is an authentication standard used to prevent email spoofing – specifically, spoofing of the domain used to deliver an email.
DKIM relies on the domain owner controlling the DNS records for that domain. When sending email with DKIM enabled, the sending server signs each message with a private key. The domain owner also publishes a DKIM record – a specially formatted TXT record – to the domain’s DNS. This record contains a public key, which receiving mail servers use to verify a message’s signature. This public-key cryptography lets recipients be confident of a sender’s authenticity.
DKIM mail flow
To understand DKIM, it helps to walk through how an email is sent once DKIM is added to the process. Let’s imagine an email is sent from sender@example.com. For DKIM to work, the following steps take place:
- Before sending the message, the sending server signs it using a private key.
- When the message is delivered, the receiving server fetches the DKIM record from the DNS records for
example.com. - The receiving server uses the public key in that DKIM record to verify the message’s signature.
- If the DKIM check passes, the receiving server can be confident the message was signed by (or on behalf of) the domain named in the DKIM signature’s
d=tag, and wasn’t altered in transit. - If the DKIM check fails, the message is likely illegitimate and gets handled by the receiving server’s own failure process.
While DKIM authentication is an email best practice, it’s worth understanding that a DKIM signature’s only function is to help verify the sender’s identity – an important factor in email delivery, but not the only one. DKIM doesn’t verify the content of an email; it just confirms who signed it and that the signed parts weren’t tampered with.
Setting up DKIM can be a fiddly process. If it’s not done correctly, ISPs (Internet Service Providers) may block your email – incorrect DKIM implementation is itself a common signal of a spammer.