What is a DKIM (Domain Keys Identified Mail) Record?

DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email message was not altered in transit and that it was authorized by the sending domain.

A DKIM record is published in DNS as a TXT record and contains the public key used by receiving mail servers to validate the email’s digital signature.

In simple terms, DKIM answers the question:
“Was this email really sent by this domain, and was it modified along the way?”

Why is DKIM Important?

Email messages can be modified or forged while traveling across mail servers. DKIM ensures message integrity and authenticity, helping mail providers trust the sender.

Key Reasons to Use DKIM:

• Prevents email tampering
• Confirms domain ownership
• Improves email deliverability
• Reduces spam classification
• Required for effective DMARC enforcement
• Protects brand reputation and trust

How Does a DKIM Record Work?

DKIM works using a public-key cryptography model.

Email Flow with DKIM:

1. The sending mail server generates a hash of the email content
2. The hash is encrypted using a private key
3. The encrypted signature is added to the email header
4. The receiving server retrieves the public key from DNS
5. The signature is validated against the email content

If the signature matches, DKIM authentication passes.

Principle of DKIM (Working Principle)

DKIM is based on cryptographic verification and DNS-based key distribution.

Core Principles:

• Private key stays securely on the sending mail server
• Public key is published via DNS
• Email headers and body are digitally signed
• Any change to the message invalidates the signature

Example DKIM DNS Record:

selector1._domainkey.example.com TXT 
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

Explanation:

• selector1 → DKIM selector
• _domainkey → Fixed DKIM namespace
• v=DKIM1 → DKIM version
• k=rsa → Key type
• p= → Public key

Pros of DKIM Record

• Ensures email integrity
• Protects against message modification
• Improves email trust and reputation
• Works well with forwarded emails
• Required for DMARC compliance
• Supported by major email providers

Cons of DKIM Record

• Requires key management
• Complex initial setup compared to SPF
• Large DNS records may cause lookup issues
• Does not validate sending IP addresses
• Needs periodic key rotation for security

Best Practices for DKIM Configuration

• Use 2048-bit keys for better security
• Rotate DKIM keys periodically
• Use clear selector naming
• Sign both headers and body
• Combine DKIM with SPF and DMARC
• Monitor DKIM failures using DMARC reports
• You can also check the DKIM DNS record status using mxtoolbox