All Glossary Terms

Glossary

DKIM (DomainKeys Identified Mail)

Cryptographically signs outgoing email to prove it has not been tampered with

DKIM (DomainKeys Identified Mail) is an email authentication method that attaches a cryptographic digital signature to outgoing messages, allowing receiving servers to verify that the email genuinely originated from the claimed domain and was not altered in transit.

What is DKIM?

DKIM, or DomainKeys Identified Mail, is an email authentication standard defined in RFC 6376. It uses public-key cryptography to attach a digital signature to each outgoing email message, giving receiving mail servers a way to verify both the origin of the message and that its content has not been modified since it was signed.

Unlike SPF, which checks the sending server's IP address, DKIM works at the message level. A signature is embedded in the email's headers, and the corresponding public key is published in the sending domain's DNS records. This makes DKIM resilient to forwarding scenarios where the sending IP changes but the message content remains intact.

DKIM is a foundational component of email security and is required for DMARC to function correctly, because DMARC can use DKIM alignment to determine whether a message is legitimate.

How Does DKIM Work?

When a mail server sends an outgoing message, it generates a cryptographic hash of selected message headers and the email body. This hash is then encrypted using the domain's private key, and the result is included in a "DKIM-Signature" header attached to the message.

The private key is held securely by the sending mail server and never published. The corresponding public key is published in a DNS TXT record at a specific selector subdomain, such as "selector1._domainkey.example.com." When the receiving server gets the email, it retrieves the public key from DNS and uses it to decrypt the signature, then independently computes the hash of the message. If both hashes match, the signature is valid.

A valid DKIM signature proves two things: the message was signed by someone with access to the private key (i.e., an authorised sender), and the signed portions of the message were not modified after signing.

How to Check Your DKIM Record

To verify your DKIM setup, use the DKIM Checker at nslookup.net/tools/dkim-checker. You will need to enter your domain and the DKIM selector used by your mail provider — this is typically found in your email platform's DNS configuration instructions.

The tool will query the DNS TXT record at the selector subdomain, parse the public key, and flag any issues such as an invalid key format or a missing record. Checking DKIM is especially important after onboarding a new email service provider or rotating your signing keys.

Related Tool

DKIM Checker

Try the Tool →

Frequently Asked Questions

What is a DKIM selector?
A DKIM selector is a label that allows a domain to publish multiple DKIM public keys in DNS simultaneously. It is specified in the DKIM-Signature header as the "s=" tag. The DNS lookup is performed at "selector._domainkey.domain.com." Using different selectors for different mail providers or for key rotation is standard practice.
Does DKIM protect the email subject and body?
DKIM can sign the email body and specific headers, including the Subject, From, To, and Date. The "bh=" tag in the DKIM signature covers the body, while the "h=" tag lists which headers are signed. If a signed header or the body is modified in transit, the signature will fail validation. However, unsigned headers or content outside the signed body hash can still be altered.
Can DKIM fail even if the email is legitimate?
Yes. Some mailing lists and forwarding services modify email content or headers — for example, by appending a footer or changing the subject line — which breaks the DKIM signature because the signed content no longer matches. This is one reason why DMARC policies should be rolled out gradually, using "p=none" first to understand how forwarded mail behaves.
How long should a DKIM key be?
The current recommendation is to use RSA keys of at least 2048 bits. Keys shorter than 1024 bits are considered insecure and should be replaced immediately. Some providers are also moving to Ed25519 elliptic-curve keys, which are shorter but offer equivalent or greater security. Key rotation every 6 to 12 months is considered good practice.