What Is DKIM and How Does Email Signing Actually Work?

If an unauthenticated email hits a modern inbox, it is immediately treated as a threat. The "From" header in a standard SMTP transaction is trivial to forge, allowing any bad actor to impersonate a CEO, a bank, or a government agency. DomainKeys Identified Mail (DKIM) is the industry-standard cryptographic solution to this vulnerability. It provides a digital "wax seal" that proves an email originated from an authorized domain and remained unaltered during its journey across the internet.

DKIM (RFC 6376) utilizes asymmetric public-key cryptography to attach an immutable digital signature to the email header. When a receiving server sees this signature, it doesn't have to take the sender's word for it; it uses mathematical proof to verify the sender's identity. Without DKIM, your outbound mail is essentially a postcard written in pencil—anyone can erase the sender's name and rewrite the message before it reaches the recipient.

---

How DKIM Works Under the Hood

DKIM operates on the principle of a private-public key pair. The domain owner generates these keys: the private key is kept secret on the sending Mail Transfer Agent (MTA), while the public key is published to the world via the Domain Name System (DNS).

When you hit "send," the mail server performs a sophisticated cryptographic sequence to secure the message:

1. Header Selection: The server identifies specific headers to protect. At a minimum, this includes From, To, Subject, and Date. These are the "signed headers" that cannot be changed later.
2. Canonicalization: Before hashing, the server "cleans" the message. Since different mail servers handle whitespace and line endings differently, DKIM uses canonicalization algorithms to ensure the sender and receiver are looking at the exact same string of characters.
3. Body Hashing: The server runs the email body through a hashing algorithm (typically SHA-256). This creates a "body hash"—a short, unique string of characters representing the entire content. If a single comma is changed in the body, the hash will no longer match.
4. Cryptographic Signing: The server combines the selected headers and the body hash, then encrypts this data using the domain’s private key. This creates the digital signature.
5. Header Injection: This signature, along with metadata about the encryption (the "selector" and the "domain"), is inserted into the email as a DKIM-Signature header.
6. Verification: Upon receipt, the destination server extracts the signature. It queries the sender's DNS for the public key. Using that key, it decrypts the signature to see what the original hash was. It then re-hashes the incoming email. If the two hashes match, the signature is valid.

---

Anatomy of a DKIM-Signature Header

To understand DKIM, you must be able to parse the raw signature header. A typical DKIM-Signature looks like a wall of random text, but every tag is a critical instruction for the receiving server.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=example.com; s=2026-alpha;
  h=from:to:subject:date:message-id:mime-version;
  bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
  b=dB/u3V...K9aW==

The Technical Tags Explained

• v= (Version): This indicates the version of the DKIM specification. Currently, this is always set to 1.
• a= (Algorithm): This defines the hashing and signing algorithms used. While rsa-sha256 is the standard, modern implementations are moving toward ed25519-sha256 for better security with shorter keys. Legacy rsa-sha1 is now considered broken and should never be used.
• c= (Canonicalization): This tells the receiver how to handle formatting changes. It follows a header/body format. simple allows for no changes at all, while relaxed ignores minor variations in whitespace and header casing. Most senders use relaxed/relaxed to prevent legitimate mail relays from accidentally breaking the signature.
• d= (Domain): The domain that took responsibility for the message. This is the domain the receiver will query for the public key.
• s= (Selector): A domain can have dozens of DKIM keys. The selector is a unique string that tells the receiver exactly which public key to look up in the DNS. This allows a company to use different keys for their marketing platform, their corporate Gmail, and their transactional billing system.
• h= (Headers): A list of the headers that were included in the cryptographic hash. If an intermediary server changes any of these headers (like the Subject line), the DKIM check will fail.
• bh= (Body Hash): The base64-encoded hash of the email body.
• b= (Signature Data): The actual cryptographic signature of the headers and the body hash. This is the "proof" that requires the private key to generate.

---

Step-by-Step Configuration Guide

Setting up DKIM is a two-part process: generating the keys in your mail system and publishing the public key to your DNS.

1. Generating Keys in Major Platforms

Google Workspace

1. Log into the Google Admin Console.
2. Go to Apps > Google Workspace > Gmail > Authenticate email.
3. Select your domain and click Generate new record.
4. Choose a 2048-bit key (1024-bit is no longer secure).
5. Copy the TXT record provided.

Microsoft 365

1. Open the Microsoft 365 Defender Portal.
2. Navigate to Policies & rules > Threat policies > Email authentication settings > DKIM.
3. Select your domain and click Enable.
4. Microsoft uses CNAME records for DKIM. You will be given two CNAME targets (e.g., selector1-example-com._domainkey.tenant.onmicrosoft.com). This allows Microsoft to rotate your keys automatically without you having to update DNS every time.

Custom Linux Servers (OpenDKIM)

If you run your own Postfix or Exim server, you use OpenDKIM. You generate a key pair via the command line: opendkim-genkey -b 2048 -d example.com -s 2026-mail This creates a .private file for your server and a .txt file containing the record for your DNS.

2. Publishing the DNS Record

You must add a TXT or CNAME record to your DNS provider (Cloudflare, Route 53, etc.).

• Host: [selector]._domainkey (e.g., 2026-mail._domainkey)
• Type: TXT
• Value: v=DKIM1; k=rsa; p=[YourPublicKey]

3. Validation and Testing

Once published, you must verify the setup. Send a test email to a service like Gmail and select "Show original" in the message menu. Look for DKIM: 'PASS'. For a deeper technical audit, use our DKIM analyzer to ensure your syntax is perfect. You can also view our full suite of email tools for broader deliverability testing. For those managing complex infrastructures, our guide on how to check SPF, DKIM, and DMARC for any domain provides a complete roadmap for domain health.

Advanced delivery systems, including Best-TempMail, utilize these exact cryptographic workflows to ensure that even temporary, high-volume communications maintain the highest possible sender reputation.

---

The Critical Limitations of DKIM

DKIM is powerful, but it is not a silver bullet. Understanding what it doesn't do is just as important as understanding what it does.

• Display Name Spoofing: DKIM verifies the domain, not the "Display Name." A hacker can sign an email with legit-sender.com but set the display name to "Bank of America Support." The DKIM signature will pass because the domain legit-sender.com is technically valid, even if the intent is fraudulent.
• No Encryption: DKIM is a signature, not a privacy shield. The contents of the email are still sent in plain text across the network. To protect the content from being read by third parties, you need Transport Layer Security (TLS).
• The "Forwarding" Problem: While DKIM survives forwarding better than other protocols, it isn't invincible. If a mailing list or an intermediate server modifies the body (by adding a footer) or changes a signed header, the DKIM signature breaks instantly.
• No Policy Enforcement: DKIM only tells the receiver if a signature is valid. It does not tell the receiver what to do if the signature is missing or broken. For that, you need a policy layer.

---

The Authentication Trifecta: SPF, DKIM, and DMARC

DKIM does not exist in a vacuum. It is one-third of a modern email security posture.

While SPF verifies which IP addresses are authorized to send mail for an envelope domain, DKIM focuses on the integrity of the message itself. This makes DKIM superior for forwarded mail, as the signature remains valid even when the sending IP address changes.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) acts as the management layer. It requires "Alignment," meaning the domain in the "From" header must match the domain used in the DKIM signature. DMARC is what gives you the power to tell receiving servers: "If the DKIM signature is missing or invalid, reject this email."

Reliable mail services like Best-TempMail implement strict DKIM signing to ensure that inbound messages are not only authenticated but also aligned with DMARC policies to prevent false-positive spam filtering.

---

Troubleshooting Common DKIM Failures

If your DKIM checks are failing, the issue usually stems from one of three technical errors:

1. DNS Record Truncation

A 2048-bit RSA key is long—often exceeding the 255-character limit for a single string in a DNS TXT record. If your DNS provider doesn't handle long strings automatically, your key will be cut off, making it mathematically useless. You must split the key into multiple quoted strings within the same TXT record to ensure the full key is published.

2. Content Modification by Middleboxes

Many corporate environments use "transparent" proxies that scan emails for viruses or add legal disclaimers to the bottom of every message. Because DKIM hashes the body, adding even a single space at the end of an email will cause the bh (body hash) to fail verification. If this is happening, you must ensure your signing happens after all modifications are complete.

3. Selector Mismatch

The most common configuration error is a simple typo. If your mail server is configured to sign with s=default, but your DNS record is published at mail._domainkey.example.com, the receiver will look in the wrong place and return an NXDOMAIN error. The selector in your server config must be an exact character match for the DNS record host.

---

Frequently Asked Questions

What is a DKIM selector?

A selector is a sub-domain string used to differentiate between multiple DKIM keys on a single domain. It allows you to host different keys for different services (e.g., mkt._domainkey for marketing and corp._domainkey for internal mail) and facilitates seamless key rotation.

Why is 2048-bit RSA preferred over 1024-bit?

1024-bit RSA keys are no longer considered "computationally expensive" to break. With modern cloud computing, an attacker can potentially factor a 1024-bit key and forge your signatures. 2048-bit keys provide a significantly higher security margin.

Can an email pass SPF but fail DKIM?

Yes. If the sending IP is authorized in the SPF record but the message body was modified in transit or the DKIM signature was stripped, SPF will pass while DKIM fails. This is why DMARC allows for "either/or" pass conditions.

How do I check if my DKIM record is working?

The fastest way is to send an email to a Gmail or Outlook account. Open the "Original Message" or "Message Headers" and look for the Authentication-Results header. If it says dkim=pass, your configuration is correct. You can also use our email tools for a comprehensive syntax check.