What Is DKIM? How DomainKeys Identified Mail Works

Every time you receive an email claiming to be from your bank, your SaaS tool, or a colleague, something needs to verify that claim. DKIM is one of the three pillars of email authentication (alongside SPF and DMARC) that makes that verification possible.

What Problem Does DKIM Solve?

Email’s original design from the 1970s has no built-in authentication. The From: header is a free-text field — any mail server can put any address there. Without authentication, spoofing support@yourbank.com requires only a mail server and about 30 seconds.

DKIM solves this by adding a cryptographic signature to outgoing email. The receiving server fetches your public key from DNS and verifies the signature. If it matches, the email demonstrably came from a server with access to your private key.

How DKIM Works: Step by Step

Sender (your mail server)                    Receiver (Gmail, Outlook, etc.)
─────────────────────────                    ───────────────────────────────
1. Compose email
2. Hash selected headers + body
3. Encrypt hash with private key      ──▶    4. Extract DKIM-Signature header
4. Add DKIM-Signature header                 5. Look up public key in DNS:
                                                selector._domainkey.domain.com
                                             6. Decrypt signature with public key
                                             7. Hash the same headers + body
                                             8. Compare hashes → PASS or FAIL

The private key stays on your mail server (or your email provider’s infrastructure). The public key is published in DNS as a TXT record.

The DKIM-Signature Header

Every DKIM-signed email includes a header like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=example.com; s=google;
  h=from:to:subject:date:message-id:content-type;
  bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
  b=XG3jKpL9rT2mN8...

The DNS TXT Record

The public key lives at {selector}._domainkey.{domain}:

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

An empty p= field (p=) signals a revoked key — receiving servers should treat signatures from this key as invalid.

Key Lengths and Algorithms

Most email providers use 2048-bit RSA. Ed25519 support is growing but not universal — check your mail server’s documentation before switching.

Setting Up DKIM

With Google Workspace

1. Admin Console → Apps → Google Workspace → Gmail → Authenticate email
2. Select your domain, click Generate new record
3. Copy the TXT record and add it to your DNS provider
4. Wait for DNS propagation (up to 48h), then click Start authentication

With Microsoft 365

# PowerShell — Exchange Online
New-DkimSigningConfig -DomainName example.com -Enabled $true
Get-DkimSigningConfig -Identity example.com | Select-Object Selector1CNAME, Selector2CNAME

Add the two CNAME records to your DNS, then enable DKIM in the Microsoft 365 admin center under Settings → Domains → your domain → Email authentication.

Manual Setup (Postfix)

# Generate key pair
openssl genrsa -out dkim_private.pem 2048
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

# Extract public key for DNS (remove headers/newlines)
grep -v "^-" dkim_public.pem | tr -d '\n'

# Postfix: install opendkim, configure /etc/opendkim.conf
# KeyFile /etc/opendkim/keys/example.com/default.private
# Domain example.com
# Selector default

DNS record to add:

default._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=<base64-public-key>"

Verifying DKIM

Via DNS lookup:

dig TXT google._domainkey.example.com
# or
nslookup -type=TXT google._domainkey.example.com

Send a test email to a Gmail address, open the message, click the three-dot menu → Show original. Look for:

DKIM: 'PASS' with domain example.com

Using DomainScan: Enter your domain at /domain/email — it fetches all _domainkey selectors and validates the record format and key size.

DKIM and DMARC Alignment

DKIM alone doesn’t prevent spoofing at the From: header level. DMARC alignment is what closes that gap.

DMARC Alignment Check:
  From: header domain  =  DKIM d= domain
  example.com          =  example.com   → ALIGNED ✓
  example.com          ≠  mailchimp.com → NOT aligned (unless relaxed)

With p=reject DMARC, an email that fails both SPF alignment AND DKIM alignment is rejected outright. This is why DKIM and SPF are the inputs to DMARC, not standalone solutions.

Common Misconfigurations

Long TXT Record Splitting

Some DNS providers can’t store TXT records longer than 255 characters. DKIM public keys often exceed this. The solution is to split into multiple quoted strings:

google._domainkey.example.com.  TXT  (
  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNA"
  "DCBiQKBgQC2s7sWLEMgMfgb9dCaGOCl6UaXuRQvt3Ku..."
)

DNS resolvers concatenate quoted strings automatically. Your mail server handles the full key.

Summary

DKIM = public-key cryptography for email. Your private key signs outgoing messages. Your public key in DNS lets any receiver verify the signature. Without DKIM, there’s no cryptographic proof your email came from you — and DMARC, which protects your brand from spoofing, depends on DKIM (or SPF) passing.

Set it up once per sending domain, verify it, and rotate keys annually.