DKIM
DomainKeys Identified Mail: a cryptographic signature added to a message by a domain that takes responsibility for it, verified with a public key in that domain's DNS.
What it means
With DKIM, the sending system hashes the message body and chosen header fields, signs the result with a private key, and adds a DKIM-Signature header naming the signing domain (d=) and a selector (s=). The receiver fetches the public key from selector._domainkey.domain in DNS and verifies the signature. A pass proves two things: the signing domain took responsibility for the message, and the signed parts were not changed in transit.
Unlike SPF, DKIM survives forwarding as long as nobody edits the signed content, which is why RFC 9989 tells domains at p=reject to sign with DKIM rather than rely on SPF. Mailing lists that add footers or change subjects break it.
The signing domain can be any domain. DMARC counts a DKIM pass only when the d= domain aligns with the From domain. The standard is RFC 6376 (2011), updated by RFC 8301 on algorithms and key sizes and RFC 8463 on Ed25519.
Example
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=mail2026; h=from:to:subject:date:message-id; bh=...; b=...Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 6376: DomainKeys Identified Mail (DKIM) Signaturesrfc-editor.org
- RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIMrfc-editor.org
- Google Workspace Admin Help: Set up DKIMknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes