DKIM signature
The DKIM-Signature header a signer adds to a message, holding the signing domain, selector, algorithm, signed header list, body hash and signature.
What it means
A DKIM signature is a header field made of tag=value pairs. Required tags are v (version, always 1), a (algorithm), d (signing domain), s (selector), h (signed header fields), bh (body hash) and b (the signature). Optional tags include c (canonicalization), i (agent or user identifier), l (body length), t (signing time) and x (expiry).
The signer computes the body hash, then signs the listed header fields plus the DKIM-Signature header itself with b= left empty. A verifier repeats the computation and checks b= with the public key found at the selector. A message can carry several signatures, for instance one from the author's domain and one from the sending platform; DMARC passes if any valid signature has an aligned d= domain.
Signatures are added as new headers at the top and should not be reordered.
Example
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s2026; t=1792540800; h=from:to:subject:date:message-id; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=; b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD00lszZVoG4ZHRNiYzRRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes