DKIM Signing and Email Authenticity

How cryptographic signatures prove an email wasn't altered in transit and genuinely came from its claimed domain.

Core Concept

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email, allowing the receiving server to verify the message wasn't altered and genuinely originated from the claimed domain.

Unlike SPF, which checks the sending server's IP, DKIM validates the message content itself using public-key cryptography.

Insight: DKIM proves message integrity and origin through cryptographic signing — it's a fundamentally different mechanism from SPF's IP-based checking.

How DKIM Signing Works

The DKIM process involves a private key held by the sender and a public key published in DNS.

Sending server signs specific headers and body content with a private key
Signature is added as a DKIM-Signature header on the outgoing message
Receiver fetches the public key from a DNS TXT record and verifies the signature

Selector-Based Keys

DKIM uses selectors, published as selector._domainkey.example.com, allowing a domain to rotate or maintain multiple signing keys simultaneously.

What DKIM Verification Confirms

A passing DKIM check gives specific, verifiable guarantees about a message.

The signed content hasn't been altered since signing
The signature was created using the domain's private key
The message genuinely passed through infrastructure controlling that key

Limitation: DKIM verifies the signing domain, which may differ from the visible From address — like SPF, it doesn't inherently guarantee alignment with what a user sees.

Key Rotation and Management

DKIM keys should be rotated periodically as a security best practice, similar to any other cryptographic credential.

Because DNS caches the public key record, rotation needs to account for propagation delay to avoid a window where signatures can't be verified.

Overlap During Rotation

Publishing a new key alongside the old one temporarily, then retiring the old one after propagation completes, avoids verification gaps during rotation.

Common DKIM Misconfigurations

A few recurring issues cause DKIM verification failures in practice.

Mail modified in transit by a forwarding service, breaking the signature
Public key record missing or malformed in DNS
Selector mismatch between the signature and the published record

Insight: Some mailing list and forwarding services rewrite message content, which breaks DKIM signatures by design — this is a known limitation, not a misconfiguration.

Real-World Implementation

DKIM is a standard component of email infrastructure for any domain sending mail at scale.

Transactional email providers signing on behalf of customer domains
DMARC relying on DKIM alignment as one of its validation paths
Regular key rotation as part of security hygiene

DKIM's cryptographic guarantee of message integrity makes it a foundational piece of any serious email authentication and anti-spoofing strategy.

Common Mistakes to Avoid

A few common mistakes cause DKIM verification failures or weaken its protection.

Rotating signing keys without overlapping old and new keys during the transition.
Overlooking that some mailing list or forwarding services break DKIM signatures by design.
Publishing a malformed or missing public key record in DNS.
Assuming DKIM alone guarantees alignment with the visible From address.
Failing to monitor for selector mismatches between the signature and DNS record.
Overlooking that not all headers need to be included in the DKIM signature.
Assuming DKIM verification failures always indicate a genuine spoofing attempt.
Failing to monitor DKIM pass rates across all legitimate sending sources.
Overlooking that some email marketing platforms require specific DKIM setup steps beyond a simple CNAME.
Assuming DKIM key length choices have no meaningful security or performance trade-off.
Failing to verify DKIM signing continues working after a mail platform migration.
Overlooking that some ESPs use shared DKIM selectors across multiple unrelated customers.

Best Practices Checklist

These practices keep DKIM signing reliable and secure over time.

Overlap old and new signing keys during rotation to avoid a verification gap.
Verify the public key DNS record is correctly published before relying on a new key.
Rotate DKIM keys periodically as a standard security hygiene practice.
Pair DKIM with DMARC to ensure alignment with the visible From address.
Monitor for DKIM failures specifically tied to known forwarding or mailing list services.
Select which headers to include in the signed content deliberately, based on what matters most.
Investigate DKIM failures for legitimate causes like forwarding before assuming malicious intent.
Monitor DKIM pass rates across every sending source to catch configuration drift early.
Follow platform-specific DKIM setup instructions carefully rather than assuming a generic process applies.
Choose DKIM key length deliberately, balancing security strength against DNS record size limits.
Re-verify DKIM signing functionality explicitly after any mail platform migration.
Confirm whether your ESP uses a dedicated or shared DKIM selector for your sending domain.

Frequently Asked Questions

Frequently asked questions about DKIM.

What does a passing DKIM check actually confirm?

That the signed content hasn't been altered since signing and that the signature was created using the domain's private key.

Why do DKIM signatures sometimes break in transit?

Some mailing list and forwarding services modify message content, which breaks DKIM signatures by design — a known limitation, not a misconfiguration.

What is a DKIM selector?

It's a value published as selector._domainkey.example.com, allowing a domain to rotate or maintain multiple signing keys simultaneously.

Does DKIM alone prevent spoofing of the visible From address?

Not entirely — DKIM verifies the signing domain, which may differ from the visible From address, which is why DMARC alignment matters.

How often should DKIM keys be rotated?

Periodically, as a standard security practice, similar to any other cryptographic credential, with overlap between old and new keys during transition.

Does DKIM sign the entire email message?

Not necessarily the entire message — the signer selects which headers and how much of the body to include in the signed content.

Does a DKIM failure always mean spoofing?

Not necessarily — legitimate causes like mailing list forwarding, which modifies content, commonly cause DKIM verification to fail too.

Why monitor DKIM pass rates across all sending sources?

Because a drop in pass rate for a specific source can reveal a configuration issue before it significantly impacts deliverability.

Do email marketing platforms all set up DKIM the same way?

No — specific setup steps vary by platform, so following provider-specific documentation carefully avoids configuration gaps.

Does DKIM key length matter?

Yes — longer keys offer stronger security but can approach DNS TXT record size limits, requiring a reasonable balance.

Do email service providers always use a dedicated DKIM selector per customer?

Not always — some use shared selectors, which is worth understanding since it affects how signing is scoped to your specific domain.

Check DKIM Configuration

Run an email security scan to verify DKIM signing status for a domain.

Launch Tool →