What Is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that allows the sending server to attach a digital signature to outgoing emails. The recipient can verify the signature using a public key published in the sender's DNS records, confirming the email has not been altered in transit.
How It Works
The sending mail server generates a cryptographic hash of the email's headers and body, then encrypts it with a private key. This signature is added as a DKIM-Signature header. The receiving server retrieves the public key from the sender's DNS TXT record and uses it to verify the signature matches the email content.
Why It Matters
DKIM proves that an email was actually sent by the domain owner and was not modified during delivery. It is a critical component of DMARC alignment and directly impacts email deliverability. Major providers like Gmail and Microsoft 365 rely heavily on DKIM for spam filtering.
Common Issues
- DKIM signature invalid due to email modification by intermediaries
- Missing DKIM DNS record
- Key length too short (512 bits is insecure)
- Body hash mismatch from content changes
- Selector misconfiguration