# DomainKeys Identified Mail (DKIM)

> A cryptographic signature that lets a domain take responsibility for selected message content.

- **Category:** Authentication
- **Updated:** July 2026
- **Canonical page:** [https://emailbump.com/glossary/dkim](https://emailbump.com/glossary/dkim)

## Definition

DKIM adds a signature header created with a domain’s private key. The receiver retrieves the matching public key from DNS and verifies that signed headers and body content have not changed beyond the allowed canonicalization.

The d= value names the signing domain and the s= value names the selector used to locate the public key. For DMARC, a passing d= domain must align with the visible From domain.

## Why it matters

DKIM establishes domain-backed responsibility and often survives simple forwarding because it is attached to the message rather than the connecting IP. Modifying signed content, however, can invalidate it.

## How it works

1. The sending service selects headers and computes a body hash.
2. It signs the result with the private key and adds a DKIM-Signature header.
3. The receiver queries selector._domainkey.signing-domain for the public key.
4. The receiver verifies the signature and returns a DKIM result.

## Example: The identity-bearing DKIM tags

```text
DKIM-Signature: v=1; a=rsa-sha256;
 d=mail.example.com; s=outbound2026;
 h=from:to:subject:date:message-id;
 bh=<body-hash>; b=<signature>
```

## Common mistakes

- Using a provider’s signing domain without configuring DMARC alignment.
- Signing too few important headers.
- Leaving weak or old keys in service indefinitely.
- Breaking signatures through mailing-list footers or gateways that modify signed content.

## Key takeaways

- DKIM validates a signed message and signing domain.
- Selectors support key rotation without changing the From address.
- Alignment—not a bare DKIM pass—is what makes it count for DMARC.

## Related definitions

- [Email authentication](https://emailbump.com/glossary/email-authentication.md) — The DNS and cryptographic mechanisms receivers use to verify sending identities and domain authorization.
- [Sender Policy Framework](https://emailbump.com/glossary/spf.md) — A DNS policy that authorizes IP addresses to use a domain in the SMTP envelope.
- [Domain-based Message Authentication, Reporting, and Conformance](https://emailbump.com/glossary/dmarc.md) — An alignment, policy, and reporting layer that connects SPF or DKIM to the visible From domain.

## Related guides

- [How to check your email domain reputation—and improve it](https://emailbump.com/blog/check-email-domain-reputation.md) — A practical guide to authenticated sending domains, Google Postmaster Tools, reputation signals, investigation workflows, stream separation, and recovery.
- [Why Gmail shows “via”—and how to fix your sender identity](https://emailbump.com/blog/gmail-via-label-dkim-alignment.md) — A practical guide to the domains behind Gmail’s via label, aligned DKIM and SPF, third-party senders, forwarding, and the headers that reveal the real problem.
- [DMARC in 2026: how it fights phishing—and where it stops](https://emailbump.com/blog/dmarc-phishing-protection.md) — A practical guide to domain alignment, reporting, safe enforcement, and the phishing attacks DMARC cannot solve on its own.

## Primary sources

- [RFC 6376: DomainKeys Identified Mail](https://www.rfc-editor.org/rfc/rfc6376)