DKIM (DomainKeys Identified Mail)
An email authentication method that adds a digital signature to verify message authenticity.
DKIM adds a cryptographic signature to your outgoing emails. Receiving servers can verify this signature to confirm the email wasn't modified in transit and came from an authorized sender.
How DKIM Works:
- Your email server has a private key
- Each outgoing email is signed with this key
- The signature is added as an email header
- You publish the public key in DNS
- Receiving servers verify the signature
DKIM Record Structure:
Type: TXT
Host: selector._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh...
Key Components:
- Selector: An identifier (like "google" or "s1")
- v=DKIM1: Version identifier
- k=rsa: Key type (RSA is standard)
- p=: The actual public key
Setting Up DKIM:
Google Workspace:
- Admin Console → Apps → Gmail → Authenticate email
- Generate DKIM key
- Add the provided TXT record to DNS
- Start authentication
Microsoft 365:
- Microsoft 365 Defender → Policies → DKIM
- Select domain
- Add the CNAME records provided
- Enable DKIM signing
Why It Matters
DKIM proves your emails are legitimate and unmodified. Without it, your emails are more likely to land in spam folders or be rejected entirely. It's a critical component of email deliverability.
Practical Example
When Google Workspace sends email from your domain, it adds a DKIM signature. Gmail's servers can verify this signature by checking your DNS, confirming the email is really from you.
Related Terms
Explore More Terms
Browse our complete glossary of domain name terminology.