Definition
DKIM adds a signature header created with a domain’s private key. The receiver retrieves the matching public key from DNS and verifies that signed headers and body content have not changed beyond the allowed canonicalization.
The d= value names the signing domain and the s= value names the selector used to locate the public key. For DMARC, a passing d= domain must align with the visible From domain.
Why it matters
DKIM establishes domain-backed responsibility and often survives simple forwarding because it is attached to the message rather than the connecting IP. Modifying signed content, however, can invalidate it.
How it works
- 01
The sending service selects headers and computes a body hash.
- 02
It signs the result with the private key and adds a DKIM-Signature header.
- 03
The receiver queries selector._domainkey.signing-domain for the public key.
- 04
The receiver verifies the signature and returns a DKIM result.
Example
DKIM-Signature: v=1; a=rsa-sha256;
d=mail.example.com; s=outbound2026;
h=from:to:subject:date:message-id;
bh=<body-hash>; b=<signature>Common mistakes
- Using a provider’s signing domain without configuring DMARC alignment.
- Signing too few important headers.
- Leaving weak or old keys in service indefinitely.
- Breaking signatures through mailing-list footers or gateways that modify signed content.
Key takeaways
- DKIM validates a signed message and signing domain.
- Selectors support key rotation without changing the From address.
- Alignment—not a bare DKIM pass—is what makes it count for DMARC.