DKIM Explained
Last updated by Stuart Larsen on
DomainKeys Identified Mail (DKIM) is an email security protocol that allows domain owners and trusted services to cryptographically sign their emails, proving to receiving mail servers that the email was sent by an authorized sender.
Record
DKIM is published as a DNS TXT record at
selector._domainkey.domain.com. Selector can be any valid DNS value, and is used to differentiate between different keys.v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvtmKI514qtdqioxRnnONfX6aeDtepubwJP+nwuvNjnw8JRrVXqxaBpiQxN0Ngqm3Tr4fPkEVMdySnQX5mTMo/hUTQXAKromYgf1N2SnYy8EpA6I32ADoPDRSRl6R/3oqB+NlET2dGwU7cBHABBLBp+N2j8TVYPbi9Vw2OogClpBFDU8I3hIXz5L2gKM3fuDl8kGLS1P8pVbCTgq11IwBWLd47KEEWI3dH8Cva5hZcBsmRGoB80pySex5tee7DYVA/QFAuHGXAcnhfenMkAZlrPdlxVaUcUveFJqnkAEL7Bv5bSGQu8WrVsfXg6ifR2Hdk4DOuXZcYZNoG1RIINeezwIDAQAB
Example of a DKIM record
The above record contains a 2048 bit public RSA key. The private key is kept secret.
Authentication
When an email service provider (for example, Google Workspace, Mailchimp, or Salesforce) wants to send an email, they sign it with a private key that corresponds to a public DKIM key. The receiving mail server can verify the DKIM signature using the public key in the DNS record, confirming that the email was sent by an authorized sender for that domain. The specific selector is specified in the email headers.
DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed; q=dns/txt; i=@paypal.com; t=1786195904; h=From:From:Subject:Date:To:MIME-Version:Content-Type; bh=U3ZFbXGSnYh7r+1dxo+5VEQLq8378Oeqg/FizeA1Q/M=; b=ht+bulwq3zY6JIf480jPdA5o2MndQ4XVe/zBGfHcWDXQvfuoWWa32MhZWf5cgB8f bPs4kul1PIAVqjrHdgwjplBXWqQIDF4tNHZb86qAHztkp/N1JgoVODuPxAmHH0Ds fU2DtA8c3WUXAvugRLvN0jwim+9HtqKHrT8Wvu/iGMv6PIbp4f0UdzJ2YBIcnmI/ yi/GSXwIRCwjTDEIhoJt8B1GXdR+rjSl7G6Yn60/yxAMXA137cufqVwWLAEl3jSj af31G6atpub2gKYBw8LCdUQJb5cqMfD3oBG7NgTA4KIuXIAbeg0YbZxLh1FOOpDT W8pKmbTlqjWLTPF8bdu6mw==;
Example DKIM-Signature from an email header
In the above DKIM-Signature, we can see the email is validated against the key from
d=paypal.com domain using selector s=pp-dkim1. So the full key can be found at TXT pp-dkim1._domainkey.paypal.com.