Email

What is DKIM?

Also known as: DomainKeys Identified Mail
Definition

DKIM cryptographically signs outgoing messages so a receiver can verify the domain and that the content was not altered in transit. The public key is published in DNS. Together with SPF it forms the basis on which DMARC makes a pass or fail decision.

Why DKIM matters

The public key is published in DNS. Together with SPF it forms the basis on which DMARC makes a pass or fail decision.

DKIM in practice

When you run a mail server, DKIM is a DNS TXT record with your public key and a selector in your mail software. You look at the Authentication-Results header in a test message you send yourself. You change the selector if you rotate keys. If you get it wrong—wrong key, wrong selector, record not propagated—receivers silently treat your mail as unsigned, and DMARC may start failing you. Your deliverability drops without a clear error in your own logs. Verifying it before you rely on it saves you that.

What people get wrong about DKIM

People assume DKIM guarantees the sender is legitimate. It doesn't. It only proves the message came from the domain that signed it. A spammer with your domain's key (stolen, misconfigured, or exposed via an open signer) signs it fine. The correction: DKIM is about integrity and alignment, not sender trust. Pair it with SPF and DMARC.

DKIM — common questions

What is a DKIM selector?

A selector is the name that ties your DKIM signature to a specific public key in DNS. For example, 'google' in google._domainkey.example.com. It lets you rotate keys without breaking mail already in transit. Keep it in sync with your mail software.

How do I test if DKIM is working?

Send a message to a Gmail or Outlook address and inspect the headers. Look for the Authentication-Results line. If it says 'dkim=pass' with your domain, it works. If it says 'fail' or 'neutral', check your DNS record and key selector.

More from email

SPF
SPF is a DNS record listing which servers are authorised to send mail for a domain.
DMARC
DMARC tells receivers what to do with messages that fail SPF and DKIM, and where to send aggregate reports.