MailVitalsEmail deliverability
Sign inEarly access
Module 2 · Lesson 6 of 37

DKIM: DomainKeys Identified Mail

Part of The Complete Email Deliverability Course — Email Authentication Protocols.

DKIM uses public-key cryptography to verify messages haven't been altered and are associated with the signing domain.

Key sizes: RFC 8301 recommends 2048-bit RSA as the standard. Ed25519 exists but major providers don't verify it yet.

The DKIM-Signature header contains:

  • d= — Signing domain (used for DMARC alignment)
  • s= — Selector name
  • c= — Canonicalization (use relaxed/relaxed)
  • h= — Signed headers (must include from)
  • bh= — Body hash
  • b= — Signature

Key rotation: Every 6–12 months. Publish the new key while keeping the old one active for 1–2 weeks.

Common DKIM failures:

  • Selector-DNS mismatch
  • Body modification by mailing lists
  • 2048-bit keys exceeding DNS string limits
  • Missing from in the h= tag

Sign in to keep track of what you have read.

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule — 41 checks, 34 blacklists, real inbox placement — and the moment something breaks it tells you what broke, why it matters, and the exact fix.

Get early access to BeatSee what Beat watches
example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 34

Illustrative. Your domain, every few hours.

Also from us:Pulse — your own sending infrastructureConsulting — $65/hr, no retainer