What Is DKIM? DomainKeys Identified Mail Explained
DKIM adds a cryptographic signature to an email message. Receiving systems retrieve the corresponding public key from DNS and use it to verify that signed message content has not been altered.
How DKIM works
The sending mail system creates a DKIM signature using a private key. The message identifies a signing domain and selector. A receiver uses those values to build a DNS name and retrieve the public key.
If the signature validates, the receiver has cryptographic evidence that the signed portions of the message were not changed after signing and that the signer controlled the private key associated with the published public key.
What a DKIM selector is
A selector lets one domain use multiple DKIM keys. The selector is included in the DKIM-Signature header and is combined with _domainkey and the signing domain when the public key is queried.
Selectors make key rotation possible without replacing every key at one DNS location.
DKIM public keys
DKIM DNS records commonly contain a key type and the encoded public key. An empty public-key value can indicate that a selector has been revoked.
RSA key strength can also be inspected when the public key can be decoded successfully.
DKIM and DMARC
Passing DKIM does not automatically mean DMARC passes. DMARC requires alignment between the domain authenticated by DKIM and the visible From domain.
This is why a DKIM checker and a DMARC alignment checker answer different questions.
Free email diagnostics
FreeMailCheck provides free tools for SPF, DKIM, DMARC, DNS, SMTP, TLS, reverse DNS, email headers and sender compliance.
Browse all 61 tools →