Validate and generate DKIM signatures for email authentication.
DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key and publishes the matching public key in the domain's DNS, so the receiving server can verify that the message was sent by that domain and was not altered in transit.
DKIM Record Generator
Create a valid DKIM record to add to your DNS configuration and complete email authentication.
Frequently Asked Questions about DKIM
DKIM is based on public key cryptography. The sender's domain generates a pair of cryptographic keys: a private key and a public key. When an email is sent, the sending server (MTA) adds a DKIM signature to the message header using the private key. This signature includes a hash value of selected parts of the email. The public key is published in a DNS record of the sender's domain. When receiving the email, the recipient's server retrieves the public key from DNS and uses it to decrypt the hash value of the signature. Then, the receiving server independently calculates its own hash value of the email. If both hash values match, the signature is valid, confirming that the email is authentic, has not been altered, and was sent from the indicated domain.
DKIM keys are pairs of cryptographic keys (private and public) used in DKIM authentication. The public key is stored as a TXT record in the sender's DNS and is used by receiving mail servers to verify DKIM signatures. The private key is kept secure on the sender's mail server and is used to generate the digital signature. A DKIM record is a set of instructions published as a TXT record in your domain's DNS configuration, containing the public key. The DKIM signature is the cryptographic signature added to the email header. The DKIM selector is a unique identifier that specifies which pair of DKIM keys was used to sign the message, allowing management of multiple keys.
Prevents message alteration: If the email is intercepted and modified, signature verification will fail, resulting in rejection or being marked as suspicious. Minimizes identity spoofing: Fraudulent emails attempting to spoof your domain will not have a valid signature with your private key and therefore will not pass DKIM authentication. Reduces spam: Proper DKIM configuration increases the reliability of your emails, reducing the chances that legitimate messages end up in the spam folder. Increases email deliverability: Improves sender reputation with Internet Service Providers (ISPs), helping important emails reach their recipients.
DKIM does not directly authenticate the "From" address visible to the end user against the signature domain in all cases; this alignment verification is part of DMARC. It depends on correct publication and retrieval of DNS records; errors or delays in propagation can cause failures. By itself, DKIM does not dictate the policy to follow if authentication fails; it only provides a "pass/fail" result and does not intrinsically stop spam or phishing. Its implementation can present technical complexity, potential deliverability issues if misconfigured, difficulties in key management, and compatibility with third-party services.
DKIM verification can fail for several reasons: The DKIM signature domain and the sender domain ("From" header) do not align. The DKIM public key record in DNS is incorrect or has not been generated. The sender domain's DNS is not available for lookups. The DKIM key length is too short (currently 1024 and 2048 bit keys are supported). The message body was modified during automatic forwarding. This often occurs when forwarding systems add footer text, invalidating the body hash. The signer does not correctly calculate the signature value, or someone forged the message without the correct private key. The public key specified in the DKIM header is incorrect or does not match the sender's public key in DNS. When a DKIM verification fails, the message may be treated with suspicion by receiving servers and marked as spam or unwanted mail.
Many technical DKIM failures can be resolved with preventive measures and monitoring. However, changes to the message body during automatic forwarding are difficult to prevent. Protocols like ARC (Authenticated Received Chains) help email providers verify if a message passed DKIM and SPF authentications with previous servers, potentially downgrading DMARC's "reject" policy if the email is legitimate.
If configured correctly, DKIM should not negatively affect legitimate emails and can improve their trust and deliverability. Although DKIM is an important tool, it alone is not sufficient for complete protection against phishing and spoofing. It is recommended to use DKIM together with SPF and DMARC for more robust security. SPF focuses on authorizing which IP addresses can send mail for a domain. DKIM verifies content integrity and that the message was authorized by the domain owner. DMARC uses DKIM (and/or SPF) authentication results to add alignment checks and policy enforcement (reject or quarantine) if they fail. It also provides reports on authentication results. As of February 2024, it is an essential requirement to have SPF, DKIM, and DMARC configured to send emails to Google and Yahoo servers. Google requires at least SPF or DKIM for new senders. BIMI (Brand Indicators for Message Identification) is based on SPF, DKIM, and DMARC implementation (with DMARC policy at p=quarantine or p=reject) to display the organization's logo alongside authenticated emails.
To configure DKIM, it is necessary to generate a pair of private and public keys (1024 or 2048 bit keys are recommended). Then, you must configure your sending mail server(s) to sign outgoing emails with the private key. Finally, publish the public key as a DNS TXT record under a specific selector name for your domain (e.g., selector._domainkey.yourdomain.com). This process must be repeated for each third-party service you use to send emails. Configuration can take an hour to take effect, so it's important to verify they are correctly configured.
You can use DKIM verification tools, entering your domain name and DKIM selector to check whether the record is properly formatted, published, and retrievable. Additionally, you can monitor DMARC aggregate reports, which provide information about DKIM authentication results for emails.
Generating keys and configuring the mail server can take from minutes to hours, depending on the system. Publishing the public key record in your DNS is usually quick, but DNS changes can take from a few minutes to 48-72 hours to fully propagate across the Internet, depending on your DNS provider and TTL configuration.
No, you cannot use the same pair of DKIM keys for different domains; each domain requires its own unique pair of DKIM keys. However, you can use independent keys for different selectors within the same domain.
Yes, Microsoft 365 (formerly Office 365) supports and uses DKIM. It is recommended to configure custom DKIM signing for your own domain(s).
No, DKIM by itself does not filter email. However, the information it provides helps filters configured by the receiving domain. For example, if an email from a trusted domain is successfully verified through DKIM, it can reduce its spam score. If the DKIM signature cannot be verified (for being fake or other reasons), the message may be marked as spam, quarantined, or receive a warning label.
