DKIM

DKIM (DomainKeys Identified Mail) lets a sending mail server attach a cryptographic signature to outgoing messages. The signature covers selected header fields and the message body, and is added to the message as a DKIM-Signature header.

The corresponding public key is published as a TXT record in DNS under selector._domainkey.example.com, where the selector lets a domain rotate or run multiple keys in parallel. A receiving server reads the selector from the signature header, fetches the public key from DNS, and verifies the signature.

Key pairs are typically 1024 or 2048 bits — 2048 is the current recommendation, though the public value must then be split into multiple strings inside the TXT record. The c= tag selects canonicalization: simple is strict about whitespace, while relaxed tolerates the small rewrites that intermediate relays often apply. The optional l= length tag, which limits the signature to the first N bytes of the body, is convenient for mailing lists but opens the door to unsigned content being appended afterwards and is generally discouraged.

A valid DKIM signature proves that the message was authorised by someone who controls the signing key for that domain and that the signed content has not been modified in transit. Because the signature travels with the message, DKIM typically survives forwarding better than SPF. Together with SPF and DMARC, DKIM forms the basis of modern email authentication.

In practice, key rotation is performed by publishing a new selector alongside the old one, switching the signing server to the new selector, and only retiring the old TXT record once messages signed with the previous key have left the network.