How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
The mechanism
A signature that proves the message was not altered.
The sending server generates an RSA or Ed25519 key pair. The private key stays on the server. The public key is published as a TXT record in DNS under a selector name.
v=DKIM1; k=rsa; p=MIIBIjANBgkqhki...
When the server sends a message, it hashes the body and a
set of headers, signs the hash with the private key, and
attaches the result as a DKIM-Signature
header. The receiver fetches the public key from DNS using
the selector in the signature and verifies that the hash
matches.
What it proves
A valid DKIM signature proves that the listed headers and the body were not modified after the signing server processed the message. It does not prove who wrote the message, only that the signing domain vouches for it.
Key strength
RSA keys shorter than 2048 bits are considered weak. Google and other major receivers downgrade or ignore signatures made with 1024-bit keys. Use 2048-bit RSA or Ed25519.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
dkim_missing
|
No DKIM signature |
dkim_signature_invalid
|
Invalid DKIM signature |
dkim_key_not_found
|
DKIM public key not found |
dkim_weak_key
|
Weak DKIM key |
More guides
Keep reading.
How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.
DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.