DomainKeys Identified Mail (DKIM) is a method to cryptographically sign email. The goal of DKIM is to reduce email spam and fraud. Receivers use DKIM as one of the methods for spam detection.
With DKIM the sending email system adds a cryptographic signature to the email using his private key. This signature is not visible in the email text, but it used by the receiving system to determine if the sender and the email content are to be trusted.
The domain owner (that's you) publishes the public key of the sender in the DNS of the domain. By doing so you tell the receiver that any sender that holds the corresponding private key is to be trusted.
DKIM is considered an improved mechanism over SPF because it also protects the email content from tampering and it doesn't suffer from the problems with email forwarding that SPF has.
To understand how DKIM works, you first need to understand what cryptographic signatures are, and how they work. If you are already familiar with cryptographic signatures and Public Key Infrastructure you can skip this segment.
A cryptographic signature is different than a 'human' signature.
A human signature is a handwritten scribble (like someones name, of even an 'X'). If placed on a document, it proves (to certain extend) the identity and intent of the signer.
A cryptographic signature is a (very long) number, that uniquely and mathematically matches to the information that was signed. The signed information can be anything that can be digitally represented, such as a document, email or financial transaction. The cryptographic signature proves identity and intent if the signer, and also authenticity of the signed information.
A cryptographic signature is created by applying a mathematical function on the information to sign in combination with a cryptographic key. The key consists of two parts (represented as long numbers) that are mathematically linked to each other. One part is called the private key, it is meant to be kept secret by its owner. The other part is called the public key, and like the name suggests it is public (not secret) information. Here comes the clever bit: a cryptographic signature can only be created with the private key, but it can be validated by anybody using the public key.
You can sign a document with a private key, and publish the resulting signature along with the document and the public key. Anyone can use the public key to validate that the signature was created with the corresponding private key. This scheme is called a Public Key Infrastructure (PKI), it allows for anyone to validate a signature without needing access to the private key.
Unlike a human signature, a cryptographic signature is unique to the information that is being signed. For every document and key combination there will be a different and unique signature. If a single letter in a signed document was to be changed, the signature would no longer be valid for that document. This means that a cryptographic signature can be used to check if a signed document is authentic, thus not been tampered with. This also makes copying a cryptographic signature pointless, as it cannot be used for anything else but the document is was created for.
|Human signature||Cryptographic signature|
|Proves||Identity, intent||Identity, intent and authenticity|
|Forgeable||Easy||Very hard to impossible|
DomainKeys Identified Mail (DKIM) leverages Public Key Infrastructure (PKI) to cryptographically sign email. The signature proves that the email is authentic and that the sender was authorized to use the domain name in the sender address. DKIM is defined in RFC 6376.
To use DKIM, a cryptographic key pair is created, usually by the administrator of an email server. The private key remains on the email server. The public key is published through DNS as a DKIM record, it is placed in the DNS of the domain that wants to allow the mail server to send email for. The sending server automatically adds a cryptographic signature to every email that it sends using the private key.
A server receiving the email will request the public key through DNS. It can then use the public key to validate the signature. If the signature is valid, it proves that:
By publishing a DKIM record in your DNS, you are saying "Any mail server that proves it has access to the corresponding private key is allowed to send email for this domain."
By adding a DKIM signature to an email, the sender is saying "Here is proof that I have access to the private key that corresponds to the public key that you will find in the DNS of the domain that I am sending for"
By validating a DKIM signature of an email, the receiver is saying "I have found proof that this email is authentic and the sender was authorized to send email for this domain"
The public key to validate the DKIM signature is published in a DNS record for the domain.
A DKIM record is of type
TXT and must be placed in at address
The selector is an identifier for the DKIM key, more about this later.
A DNS query on
[selector]._domainkey.[domain] may only result in 1
TXT type record maximum.
If you have multiple keys, you can publish each corresponding public key with a different selector.
That way different private keys can be used to sign the email.
For example: You can have a key for your own mail server and one for a third party such as Mailchimp.
DKIM keys are not meant to ever change. If you need to use a new DKIM key, you should use a new selector also. Because DKIM records never change they can have a high time-to-live (TTL) value. A TTL of 1 day (86400 seconds) or more is not uncommon for DKIM records.
Here is an example of a DKIM record:
google._domainkey.mailhardener.com. 86400 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgAF0AKrnAY2oscOh7jlBBPJDHgWO/HR/TxPr18yG6uFs3jVLkz1qZpI0QJX90aVnpPiu1C+6MZzUwzYYY/f8g8rVGxwj2D/anjih4sKUFmun2IluFiS93RcPZXYWNXor4gALdsdAVB7ak4/30l0uVAU3OEwFX77yWNT6BDSiobfpKMDG4TV4iZiohOlc1gHHX" "HYbLbcQ1uM9CLPkuqHKQkudLjvAbvl0eqDtAzThAahsmhl5Lc7Qru1SJShv47RxzIxShBL6MGTxEGiIR09244oQf++CmKCT8TPxptT/Y6mrLO5+t//dlvSVLsrKhF6xqZWwSOL0pskJiDdqDAxDGQIDAQAB"
We have a DKIM inspection tool available here, you can use it to inspect and validate a DKIM DNS record.
Every DKIM record must have a unique identifier known as the selector. The selector is part of the address that is used to find the DKIM record in the DNS. A DKIM signature in an email will also contain this selector so the receiver knows where to look up the DKIM record.
Since the selector is used as the DNS name of the DKIM record, it can contain only characters that are valid for a domain name. So a maximum of 255 characters containing letters, numbers and hyphens (-). Spaces, dots, and underscores are not allowed. Like with DNS names, a selector is not case sensitive.
The DKIM header is the header that is added to an email that contains the signature.
An email consists of 2 parts: the headers and the actual email contents, known as the body. The headers contain information such as the date, subject, return address and more. The headers are used by email servers and clients to process the email. Most email programs will hide the headers from the user.
When using DKIM, a header value is added to the email that contains the DKIM signature, the selector and implementation details instructing the receiving system on how to validate the signature.
As explained in our document about SPF, SPF is also used to authorise a mail server to send email for a given domain. So why use DKIM, if SPF is much easier to set up?