What Is DKIM and How Does Email Signing Work?

The Problem DKIM Solves

Email passes through multiple servers between sender and recipient — mail transfer agents, spam filters, mailing list processors. Any of these could modify the message in transit. DKIM provides a way to cryptographically verify that the message body and key headers have not been altered and that the signing domain vouches for the message.

How DKIM Signing Works

1. The sending mail server generates a public/private key pair.
2. The public key is published in DNS as a TXT record at selector._domainkey.domain.com.
3. For each outgoing message, the server computes a hash of specified headers (From, Subject, Date) and the message body.
4. It encrypts that hash with the private key to produce the DKIM signature.
5. The signature is added to the message as a DKIM-Signature header.

How Receiving Servers Verify DKIM

1. The receiving server reads the DKIM-Signature header.
2. It extracts the selector (s=) and domain (d=) values.
3. It queries DNS for the public key at selector._domainkey.domain.com.
4. It decrypts the signature with the public key.
5. It recomputes the hash of the specified headers and body.
6. If the hashes match, the signature is valid.

The DKIM-Signature Header

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=example.com; s=mail2024;
  h=from:to:subject:date:message-id;
  bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
  b=dGhpcyBpcyBhIGZha2Ugc2lnbmF0dXJl...

Key fields:

• d= — signing domain
• s= — selector (identifies which key pair)
• h= — headers included in the signature
• bh= — hash of the message body
• b= — the signature itself

DKIM Selectors

A domain can have multiple DKIM key pairs active simultaneously, identified by different selectors. This allows rotating keys without downtime — add the new key, update your mail server, then remove the old key.

DKIM and Forwarding

Unlike SPF, DKIM signatures survive email forwarding because the signature travels with the message. This is why DMARC relies on DKIM for forwarded email scenarios.

Key Length Recommendations

• RSA 1024-bit: deprecated, should be rotated
• RSA 2048-bit: current minimum recommendation
• RSA 4096-bit or Ed25519: recommended for new deployments

Check any domain's DKIM record with our DKIM Record Checker.