DKIM

DKIM is an email authentication method that lets a sending system attach a digital signature to a message using a domain's private digital key, which the sender keeps secret. A receiving system can retrieve the matching public key, used to verify the signature, from DNS and check whether the signed parts still match. A passing signature shows that the signing domain took responsibility for those parts of the message; it does not prove who personally wrote the message or that its contents are trustworthy.

How does a DKIM signature get checked?

The sender adds a message information field called the DKIM-Signature header to the message. It identifies a signing domain and a selector, which tells the receiver where to find the public key in DNS. The sender keeps the private key; the public key is published in a TXT record under a name such as selector._domainkey.example.com.

For example, a provider signs a message for example.com with a selector called mail2026. The recipient looks up the corresponding DNS key and checks the signature for selected message information fields (headers) and the message body. If signed content has changed in transit, verification can fail. Some legitimate mailing lists or systems alter messages, so failure alone does not establish malicious intent.

What does DKIM not prove?

DKIM authenticates a signing domain, not necessarily the domain shown in the visible From address. DMARC checks whether the authenticated DKIM domain matches that visible author domain under DMARC's rules, or whether a passing SPF result has a matching domain under those rules. Even a valid DKIM signature does not judge whether the message is wanted, accurate, or safe to open.

Related terms

• TXT record — publishes the public key
• DMARC — checks domain matches and the requested handling of failures
• SPF — another email authentication method
• Email spoofing — impersonation DKIM can help detect