Definition
DKIM (DomainKeys Identified Mail) is an email authentication protocol that allows a domain to cryptographically sign its outgoing emails. The receiving server can verify the signature using a public key published in the sender's DNS records, confirming that the email was genuinely sent by the domain and was not modified in transit.
DKIM is more secure than SPF because it uses public-key cryptography and verifies email content, not just the sending server. It is one of the three foundational authentication protocols alongside SPF and DMARC.
How DKIM Works
- The sending mail server generates a private-public key pair
- The public key is published as a TXT record in the sender's DNS (the DKIM record)
- When an email is sent, the sending server creates a digital signature of the email headers and body using the private key
- The signature is added to the email as a DKIM-Signature header
- The receiving server looks up the sender's public DKIM key from DNS
- The receiving server decrypts the signature and verifies it matches the email content
- If the signature is valid, DKIM passes
DKIM Record Format
A DKIM record is a TXT record in DNS stored under a specific selector:
default._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb4..."
| Tag | Description | Example |
|---|---|---|
v= |
DKIM version | DKIM1 |
k= |
Key type | rsa or ed25519 |
p= |
Public key (base64 encoded) | Long base64 string |
s= |
Service type | email (default) |
t= |
Flags | y for testing mode |
DKIM Selectors
A DKIM selector is a label that identifies which public key to use for verification. Multiple selectors allow a domain to have multiple DKIM keys simultaneously:
- Each email service provider (ESP) that sends on your behalf uses a different selector
- Selectors simplify key rotation without breaking email authentication for existing messages
- Common selectors include
google,s1,default,mail, or provider-specific names
DKIM vs SPF
| Factor | DKIM | SPF |
|---|---|---|
| Mechanism | Digital signature | IP address check |
| What is verified | Email content was not tampered with | Sending server is authorised |
| Survives forwarding | Yes (signature travels with the message) | No (forwarding changes the envelope sender) |
| Key management | Requires key generation and rotation | Simple DNS text record |
| Security strength | Higher (cryptographic) | Lower (IP-based) |
Was this useful?
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
AI Email Summary
An AI email summary is a short, machine-generated overview of an email's key points, shown by Gmail, Outlook and Apple Mail before a recipient opens the message. It is reshaping how email marketers think about subject lines, preview text and open rates.
AI Inbox Summary
An AI inbox summary is an AI-generated digest that condenses unread email — often highlighting news, actions and senders — changing how clearly your marketing email reaches and engages subscribers.
AI Inbox
An AI inbox is an email client that uses artificial intelligence to summarise, sort, prioritise and sometimes answer emails before the human recipient reads them. It is transforming email marketing metrics and copywriting.
Frequently Asked Questions
Most major mailbox providers require either DKIM or SPF for reliable delivery, and strongly recommend both. DMARC requires at least one of SPF or DKIM to pass with alignment. Gmail and Yahoo's 2024 bulk sender requirements mandate both authentication methods.
Generate a DKIM key pair through your email service provider or hosting provider. Publish the public key as a TXT record in your DNS under the selector provided by your ESP. Most ESPs (Mailchimp, SendGrid, Klaviyo) provide step-by-step DKIM setup instructions within their platform.
The receiving server checks the DKIM signature. If it is missing or invalid, DKIM fails. The email may still be delivered if SPF passes and the sender has sufficient reputation, but DMARC requires either SPF or DKIM to pass with alignment. DKIM failure alone does not guarantee rejection.
DKIM keys should be rotated periodically for security. Key rotation involves generating a new key pair, updating the DNS record with the new public key, and retiring the old key after existing signed emails have age. Some ESPs handle key rotation automatically. Best practice is to rotate DKIM keys every 6-12 months.
Yes. DKIM signatures include a timestamp and can expire based on the receiving server's policy. In practice, most receiving servers validate DKIM signatures at the time of delivery and do not re-validate old messages. The signature itself does not expire as long as the public key remains in DNS.