DKIM: How Email Signing Works

What is DKIM?

DKIM is an email authentication method that uses public-key cryptography to digitally sign outgoing emails. Think of it as a tamper-evident seal for your messages. When you send an email, your mail server creates a unique signature using a private key that only you control. Recipients can then verify this signature using a public key published in your DNS records.

This cryptographic approach provides two key guarantees:

How DKIM Works

The DKIM process involves two main steps: signing when sending and verification when receiving.

Signing (Outbound)

1. Your mail server takes the email content (headers and body)
2. It creates a hash of this content using a cryptographic algorithm
3. The hash is encrypted with your domain's private key to create the signature
4. The signature is added to the email as a DKIM-Signature header

Verification (Inbound)

1. The receiving server extracts the DKIM-Signature header
2. It looks up the public key in your domain's DNS records
3. Using the public key, it decrypts the signature to get the original hash
4. It calculates its own hash of the received message
5. If both hashes match, the signature is valid

DKIM Record Structure

DKIM public keys are published as TXT records in DNS. The record is located at a specific subdomain that combines the selector with "_domainkey".

Host: selector._domainkey.example.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Record Components

The Selector

The selector is a name you choose that identifies which key to use. This allows you to have multiple DKIM keys for different purposes or to rotate keys without disruption.

# Common selector naming conventions
google._domainkey.example.com    # For Google Workspace
s1._domainkey.example.com        # Generic numbered selector
2024-01._domainkey.example.com   # Date-based for rotation
mail._domainkey.example.com      # Generic mail selector

The DKIM-Signature Header

When your mail server signs an email, it adds a DKIM-Signature header. This header contains all the information needed to verify the signature.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=example.com; s=selector1;
  h=from:to:subject:date:message-id;
  bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
  b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVFOk4yAUoqOB
    4nujwH2vXN6P1ksKU5kMdC1sNTzmJIJv/zMbh5N/N4N/B...

Key Header Tags

Setting Up DKIM

The exact steps vary by email provider, but the general process is:

Step 1: Generate a Key Pair

Most email services generate this for you. If you need to generate your own (for self-hosted mail servers):

# Generate a 2048-bit RSA private key
openssl genrsa -out dkim_private.pem 2048

# Extract the public key
openssl rsa -in dkim_private.pem -pubout -out dkim_public.pem

Step 2: Add the DNS Record

Publish your public key as a TXT record. Your email provider typically gives you the exact record to add.

# Example for Google Workspace
Host: google._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

# Example for Microsoft 365
Host: selector1._domainkey
Type: CNAME
Value: selector1-example-com._domainkey.example.onmicrosoft.com

Step 3: Enable DKIM Signing

Once DNS propagates (can take up to 48 hours), enable DKIM signing in your email service. This tells your mail server to start signing outgoing messages.

Step 4: Verify the Setup

Send a test email and check the headers to confirm DKIM is working:

Authentication-Results: mx.google.com;
  dkim=pass header.i=@example.com header.s=google header.b=abc123

Common DKIM Issues

v=DKIM1; k=rsa; p="MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."
"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."

Summary

Resources