Glossary · Authentication

DomainKeys

The Yahoo-designed predecessor of DKIM, documented in 2007 as Historic RFC 4870, which signed messages with a DomainKey-Signature header.

What it means

DomainKeys introduced the ideas DKIM kept: a signature header, a public key in DNS under a selector, and the _domainkey label. RFC 4870 calls it a primary source from which DKIM was derived and was published with Historic status, as a reference for implementations written before DKIM. DKIM itself became RFC 4871 the same month and was revised as RFC 6376 in 2011.

DMARC and today's receivers evaluate DKIM-Signature headers. A DomainKey-Signature header left by an old system counts for nothing.

The overlap in names causes confusion: _domainkey records today are DKIM records.

Sources

What this definition rests on. The wording is ours; the facts are theirs.

RFC 4870: Domain-Based Email Authentication Using Public Keys Advertised in the DNS (DomainKeys)rfc-editor.org
RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.4.1rfc-editor.org

All 432 terms in the glossary The wiki: blocklists and bounce codes

What it means

Related terms

Sources

A heartbeat for your email.