Cybersecurity
DKIM
DKIM (DomainKeys Identified Mail) is an email authentication method using digital signatures. The sending server signs messages with a private key, and the recipient verifies the signature using a public key in DNS. DKIM confirms message integrity and sender authenticity.
DKIM Definition
DKIM (DomainKeys Identified Mail) is an email authentication standard that uses cryptographic signatures to confirm that a message was actually sent by the domain’s authorized server and wasn’t modified in transit. DKIM is one of three fundamental email security mechanisms alongside SPF and DMARC.
How Does DKIM Work?
Sending:
- Mail server generates message hash
- Signs hash with domain private key
- Adds DKIM-Signature header
Receiving:
- Recipient server reads DKIM header
- Retrieves public key from DNS
- Verifies signature
- Confirms message integrity
DKIM Signature
Example DKIM header:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector;
h=from:to:subject:date; bh=base64hash; b=signature- v: Version
- a: Algorithm (rsa-sha256)
- d: Signing domain
- s: Selector (key identifier)
- h: Signed headers
- bh: Body hash
- b: Signature
DKIM DNS Record
selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."- selector: Key identifier (enables rotation)
- k: Key type
- p: Public key
DKIM vs SPF
| Aspect | DKIM | SPF |
|---|---|---|
| What it checks | Signature | Sender IP |
| Integrity | Confirms no modification | No |
| Forwarding | Works when forwarded | Breaks |
| Configuration | More complex | Simpler |
DKIM Benefits
- Integrity: Confirmation of no modification
- Authenticity: Proof of origin
- Forwarding support: Works when forwarded (unlike SPF)
- Reputation: Better deliverability
- DMARC foundation: Required for full DMARC
DKIM Implementation
- Key generation: Private/public key pair
- DNS configuration: Adding TXT record with public key
- Server configuration: Signing outgoing messages
- Testing: Verifying signature correctness
- Rotation: Periodic key changes
DKIM Best Practices
- Key length: Minimum 2048 bits
- Regular rotation: Periodically change keys
- Multiple selectors: For different services
- Monitoring: Tracking verification failures
DKIM is an essential email security element that, combined with SPF and DMARC, provides comprehensive protection against spoofing.