DKIM, explained
DKIM puts a signature on every message you send, and a public key in DNS that receivers use to check it. Here is how it works, what a good setup looks like, and how it fits with SPF and DMARC.
By the TrustSek editorial team · Last reviewed
- Module
- Email security
- Key size
- 2048 bits recommended
- Standard
- RFC 6376
DKIM, DomainKeys Identified Mail, is the second of the three records that protect a domain from forgery. SPF says which servers may send for you; DKIM proves that a message was signed by someone holding your key and was not changed on the way. DMARC then ties both to the address the recipient sees.
How a DKIM signature works.
The sending server signs selected headers and the body of each message with a private key, and adds the result as a DKIM-Signature header. That header names the signing domain (d=) and a selector (s=). The receiving server looks up the public key at selector._domainkey.domain in DNS and checks the signature. If the message was altered, or signed with another key, the check fails.
A published key looks like this:
s1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
Selectors: one per sender, and invisible from outside.
The selector lets a domain publish several keys at once: one for your mail platform, one for a newsletter service, one for your ticketing system. Each service gets its own selector, so you can replace one key without touching the others.
Selectors have no index. DNS cannot list every key a domain publishes, so nobody outside your organisation can see a complete picture of your DKIM setup. That matters for anyone assessing it from the outside, including us.
Key size: 2048 bits.
RFC 8301 sets the minimum RSA key size at 1024 bits and recommends 2048. Keys below 2048 bits are considered weak, because forging a signature becomes feasible over a key's lifetime. Most providers now generate 2048-bit keys by default; older setups often still publish 1024-bit keys that were never replaced.
Ed25519 keys (RFC 8463) are much shorter and strong, but not every receiver verifies them yet. If you use one, sign with an RSA key alongside it.
DKIM and DMARC: the signing domain must align.
A valid DKIM signature only helps DMARC when the signing domain matches the domain in the From address. Many services sign with their own domain by default, so the signature is valid but unaligned, and DMARC treats it as if there were no DKIM at all. For each service that sends as you, set it up to sign with your domain, usually by publishing a selector record or CNAME the service gives you.
The guide How to move DMARC from p=none to p=reject shows how to use DMARC reports to find services that are not yet aligned.
Rotate keys without breaking mail.
Replace keys on a schedule, and immediately if a private key may have leaked:
- Publish the new public key under a new selector.
- Switch the sending service to sign with the new key.
- Keep the old record published for some days, until mail signed with it has been delivered.
- Remove the old record, or publish it with an empty
p=to revoke it.
Common mistakes.
- A 1024-bit key left from an old setup.
- A service signing with its own domain, so DKIM passes but does not align for DMARC.
- The testing flag
t=yleft in the record after setup. - A key record split wrongly across TXT strings, so receivers cannot parse it.
What TrustSek checks.
Because selectors cannot be listed, the scan looks for keys under common selector names used by the major mail platforms. For each key it finds, it reads the key size:
| What the scan finds | Finding | Severity |
|---|---|---|
| A key below 2048 bits | DKIM key below recommended size | Varies |
The severity is higher when the key is below 1024 bits. Finding no key raises no finding: absence among the selectors the scan knows is not proof that you have no DKIM. DKIM is part of the email security module, alongside SPF and DMARC.
Questions
Is DKIM enough on its own?
No. DKIM proves who signed a message, but it does not tell receivers what to do with mail that fails. That is DMARC's job, and DMARC needs SPF or DKIM to pass in alignment with the From address.
Why does my DKIM pass but DMARC fail?
Usually because the service signs with its own domain rather than yours. The signature is valid but not aligned. Set the service up to sign with your domain.
Check your domain's email security
See what the full scan finds in your DMARC, SPF and DKIM setup, and the rest of the outside-in score.