How to Configure DKIM for Your Domain

1. Generate RSA-2048 key pair: openssl genrsa -out dkim.private 2048 && openssl rsa -in dkim.private -pubout -out dkim.public
2. Convert public key to DNS format: strip header/footer and newlines — single line
3. Create TXT record: name mail._domainkey (where mail is the selector), value v=DKIM1; k=rsa; p=PUBLIC_KEY
4. Enable signing in the mail server (Postfix: opendkim; Google Workspace: Admin → Apps → Gmail → Authenticate email)
5. Send a test email — check the DKIM-Signature header at the recipient
6. Verify via Enterno DKIM Checker — enter domain + selector
7. Confirm via check-auth@verifier.port25.com

• RSA key below 1024 bit — Gmail rejects. Minimum 1024, recommended 2048
• Line breaks / whitespace inside the public key → invalid record
• Selector must match DNS and message header — a typo breaks everything
• After key rotation, keep the old selector for 14 days so mail in flight still validates
• Never store the private key in git — compromise = spoofing

To set up DKIM email signing, generate a DKIM key pair using a tool like OpenSSL, then publish the public key as a TXT record in your DNS settings. Configure your mail server (e.g., Postfix, Exim) to use the private key for signing outgoing emails. This process enhances email deliverability and mitigates spoofing, crucial for businesses operating in the US and EU.

DomainKeys Identified Mail (DKIM) is an email authentication method that allows senders to digitally sign their emails, ensuring that the content has not been altered in transit. By implementing DKIM, organizations can protect their email domain from spoofing and phishing attacks, thus enhancing their sender reputation and email deliverability rates.

In the context of the EU's General Data Protection Regulation (GDPR) and the CAN-SPAM Act in the US, maintaining a secure email infrastructure is not just a best practice; it's a regulatory requirement. Failing to authenticate emails can lead to significant legal and reputational consequences.

How DKIM Works

DKIM uses a combination of public and private keys to sign emails. The sender's mail server generates a hash of the email content and a unique identifier. This hash is then encrypted using the sender’s private key and added to the email header. The recipient’s mail server retrieves the public key from the DNS records to verify the signature.

Key Components of DKIM

• Private Key: Used by the sender’s mail server to sign the email.
• Public Key: Published in the DNS record, allowing recipient servers to verify the signature.
• DKIM-Signature Header: Contains the signature and additional metadata like the signing domain and the selector.

For example, the DKIM-Signature header might look like this:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=default; c=relaxed/simple; h=from:to:subject:date; bh=xyz123...; b=abc456...

In the above example, d=example.com indicates the signing domain, while s=default specifies the selector used to locate the public key in DNS.