DKIM
What is DKIM?
DKIM lets a sending domain cryptographically sign outgoing email with a private key, adding a header a receiver verifies against a public key published in DNS, confirming the message wasn't altered after signing. AdminKit's DKIM check tool checks a domain's DKIM record for the signing errors RFC 6376 compliance depends on.
By AdminKit team, Netbase JSC · Updated
DKIM (DomainKeys Identified Mail) lets a sending domain cryptographically sign outgoing email with a private key, adding a DKIM-Signature header that covers key parts of the message. The receiving server looks up the corresponding public key from a DNS TXT record at a selector-specific hostname (selector._domainkey.example.com) and verifies the signature, confirming the message wasn’t altered after signing and genuinely originated from a system holding that domain’s private key. How that public key gets into DNS varies by provider: Microsoft’s DKIM guide for Microsoft 365 has custom domains publish CNAME records for DKIM, noting that other email systems might use TXT records. Unlike SPF, which authenticates the sending IP, DKIM authenticates the message content itself and survives forwarding through an intermediate server, which is why DMARC checks both mechanisms together. DKIM is defined in RFC 6376, whose header tags (such as d=, s= and bh=) are catalogued in IANA’s DKIM-Signature Tag Specifications registry. The receiving server typically records its verdict in the same Authentication-Results header it uses for SPF and DMARC.
What a DKIM signature actually proves:
- The message wasn’t altered after the sending domain signed it.
- It genuinely originated from a system holding that domain’s private key.
- It survives forwarding through an intermediate server, unlike SPF’s IP-based check.
Frequently asked questions
What does a DKIM signature actually prove?
It proves the message wasn't altered after the sending domain signed it, and that it genuinely originated from a system holding that domain's private key. It does not prove the message is free of spam or malicious content -- only that the signed parts are intact and the signer controls the domain in the signature.
How is DKIM different from SPF?
DKIM authenticates the message content itself with a cryptographic signature, while SPF authenticates the sending IP address against a list a domain publishes in DNS. Because DKIM's signature travels with the message, it survives forwarding through an intermediate server, unlike SPF's IP-based check.
Where does a receiver find the public key to verify a DKIM signature?
In a DNS TXT record at a selector-specific hostname, such as selector._domainkey.example.com, where "selector" is named in the DKIM-Signature header itself. The receiving server fetches that record and uses the key in it to verify the signature.
Does passing DKIM alone stop email spoofing?
No -- DKIM alone only confirms the signed message wasn't altered and came from a holder of the signing key; it says nothing about whether the visible From address matches the signing domain. DMARC is what ties DKIM (and SPF) results to that visible From address and tells a receiver what to do on failure.