Ruvalin

Definition

DKIM

DomainKeys Identified Mail

DKIM is a cryptographic signature added to the headers of every outgoing message, which the receiving server verifies using a public key published in the signing domain's DNS under a name called a selector.

Where SPF authorises servers, DKIM authenticates messages. The signature covers a set of headers and the message body: if either is altered in transit, verification fails. This is also what gives DKIM its decisive advantage over SPF, a signature survives forwarding, an IP authorisation does not.

The DKIM-Signature header reads: d= the signing domain, s= the selector saying where to find the public key, b= the signature itself and bh= the body hash. For DMARC only d= matters: it is the value that has to align with the visible From domain.

Where a selector's public key lives
dig +short TXT google._domainkey.example.com
Also known as
DKIM, DKIM signature, DomainKeys Identified Mail, _domainkey
Standard
RFC 6376

See also

In the guides

The whole glossary

CallBook