DKIM: Definition and Use Cases

DKIM (DomainKeys Identified Mail) is a cryptographic signature added to email by the sender. The public key is published in DNS (selector._domainkey.example.com); the private key signs the message body. The recipient verifies the signature, guaranteeing the message was not modified in transit and truly came from the claimed domain.

Open Enterno.io tool →

DKIM (DomainKeys Identified Mail) employs a combination of public and private key cryptography to provide email authentication. The process begins when the sender's mail server generates a unique DKIM signature for each outgoing email. This signature is created by hashing the email's headers and body, and then encrypting that hash with the sender's private key.

Here’s how the entire process unfolds:

• Email Creation: The sender composes an email and the mail server prepares to send it.
• Hash Generation: The server creates a hash of the email’s headers and body using a secure hashing algorithm like SHA-256.
• Signature Creation: The hash is then encrypted using the sender's private key, producing the DKIM signature.
• DNS Record: The public key corresponding to the private key is published in the sender's DNS records, typically under the format selector._domainkey.example.com.
• Email Transmission: The signed email is sent to the recipient.

Upon receiving the email, the recipient's mail server retrieves the public key from the DNS, decrypts the DKIM signature, and compares the resulting hash to the hash of the received email. If they match, the email is verified as authentic and unaltered.

Implementing DKIM involves several steps, including generating keys, creating DNS records, and configuring your mail server. Below are practical steps to set up DKIM:

1. Generate DKIM Keys: You can use tools like OpenSSL to generate your DKIM keys. Run the following commands:

2. Create a DKIM DNS Record: You need to create a TXT record in your DNS settings. The record should look something like this:

3. Configure Your Mail Server: Depending on your mail server (Postfix, Sendmail, etc.), you will need to configure it to use the private key for signing outgoing emails. For example, in Postfix, you can use the following configuration:

Ensure you replace localhost:8891 with the appropriate address and port of your DKIM signing service.

4. Test Your DKIM Setup: You can use tools like MXToolbox DKIM Lookup to verify that your DKIM is set up correctly. Send a test email to yourself and check the headers to see if the DKIM signature is present and valid.

While DKIM is a robust email authentication method, users may encounter various issues during setup or operation. Here are some common problems and their solutions:

• DKIM Signature Missing: If the DKIM signature is not present in the email headers, ensure that your mail server is configured correctly to sign outgoing messages. Check your mail logs for errors related to DKIM signing.
• Verification Failures: If the recipient's server reports that the DKIM verification failed, ensure that the public key published in your DNS matches the private key used for signing. Any discrepancies will cause verification to fail.
• DNS Propagation Issues: After updating DNS records, it may take time for changes to propagate. Use tools like dig to check if your DKIM record is visible:

Wait a few hours and recheck if necessary.

• Key Length and Algorithm Issues: Ensure that your DKIM keys are of adequate length (2048 bits is recommended) and that you are using a supported algorithm (RSA is the most common). If using a shorter key, consider regenerating it.

By addressing these common issues, you can ensure your DKIM implementation functions correctly, enhancing your email deliverability and security.