DKIM (DomainKeys Identified Mail)
What is DKIM (DomainKeys Identified Mail)?
An email authentication standard (RFC 6376) that attaches a cryptographic digital signature (`DKIM-Signature` header) to outgoing messages. Receiving mail servers fetch the sender's public RSA or Ed25519 key from DNS (`selector._domainkey.domain.com`) to verify that the email headers and body were not tampered with in transit.
Why DKIM (DomainKeys Identified Mail) Matters in Production
Unlike SPF—which breaks when an email is forwarded through an intermediary server—a valid DKIM signature survives forwarding intact, making DKIM the primary cryptographic anchor for DMARC alignment and domain reputation.
Engineering & Sender Best Practices
- • Use 2048-bit RSA keys whenever your DNS provider supports multi-string TXT records.
- • Assign a dedicated DKIM selector per sending service (e.g., `postmark._domainkey`, `klaviyo._domainkey`) for clean key rotation.
- • Rotate DKIM keys every 6 to 12 months by publishing a new selector before retiring the old one.
- • Verify that the `d=` domain in your `DKIM-Signature` aligns with your visible `From:` header domain.
Zero-Downtime 2048-Bit DKIM Key Rotation Across Multi-ESP Stacks
A fintech company sending transactional alerts via Postmark, marketing campaigns via Customer.io, and corporate mail via Google Workspace failed DMARC alignment on forwarded emails because one legacy ESP was still using a 1024-bit key with a misaligned d= domain. By provisioning dedicated 2048-bit selectors per provider (pm2026._domainkey, cio2026._domainkey) aligned with their organizational domain, DKIM pass rates hit 99.94%.
Technical Implementation & Wire Example
; DKIM Public Key published at selector._domainkey.yourdomain.com
s2026._domainkey.yourdomain.com. 3600 IN TXT (
"v=DKIM1; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy8V2x7..."
)Receiving MTAs query the selector specified in the email's DKIM-Signature header to verify cryptographic authenticity.
DNS Email Authentication & Routing Protocol Reference
Gmail, Yahoo & Microsoft 365 Bulk Sender Standards| Protocol | DNS Host & Type | RFC Spec | Operational Requirement & Failure Impact |
|---|---|---|---|
| MX | @ (IN MX) | RFC 5321 / 7505 | Routes inbound mail by priority; missing or Null MX (0 .) causes 100% hard bounce |
| SPF | @ / Return-Path (IN TXT) | RFC 7208 | Authorizes sending IPs/ESPs; must stay strictly ≤10 DNS lookups to avoid PermError |
| DKIM | selector._domainkey (TXT/CNAME) | RFC 6376 | 2048-bit cryptographic header signature; survives email forwarding intact |
| DMARC | _dmarc (IN TXT) | RFC 7489 | Enforces From-domain alignment (p=none, p=quarantine, p=reject) + RUA reports |
| ARC / BIMI | default._bimi (IN TXT) | RFC 8617 | Preserves auth across forwarders (ARC) and displays verified brand logos (BIMI) |
How to Read Email Headers: Decoding DKIM-Signature, SPF & Return-Path →
Step-by-step guide to inspecting DKIM-Signature tags (d=, s=, bh=, b=) and Authentication-Results headers across Gmail and Outlook.
Free Authentication & DNS Tools & Workflows
Frequently Asked Questions About DKIM (DomainKeys Identified Mail)
Why does DKIM survive email forwarding when SPF fails?
When a recipient auto-forwards an email to another address, the forwarding server connects from its own IP address—causing SPF to fail for the original sender domain. Because DKIM signs the message headers and body cryptographically, the signature remains valid as long as the forwarding server does not alter the signed headers or body.
Why does my DNS provider split a 2048-bit DKIM key into multiple quoted strings?
A single DNS TXT character-string is limited to 255 bytes by RFC 1035, whereas a 2048-bit RSA public key base64 payload exceeds 390 characters. DNS resolvers automatically concatenate adjacent quoted strings inside a single TXT record into one continuous key.
How many DKIM selectors can a single domain publish at the same time?
Unlike SPF (which allows only one v=spf1 record per hostname), a domain can publish dozens of simultaneous DKIM records because each service queries its own unique selector subdomain (`<selector>._domainkey.yourdomain.com`).
Closely Related Terms
Explore All Email Verification Terms (A–Z)
Glossary Index →Ready to start verifying emails?
Get 1,000 free credits when you sign up. No credit card required.