What Is DKIM (DomainKeys Identified Mail)?

Definition

DKIM (DomainKeys Identified Mail) is an email authentication standard that adds a digital signature to each outgoing message. The sending domain publishes a public key in DNS, and receiving servers use it to confirm that the message was signed by that domain and was not altered in transit.

How It Works

DKIM is defined in RFC 6376, which says it "permits a person, role, or organization that owns the signing domain to claim some responsibility for a message."

Signing: your email service signs selected headers and the body with a private key and adds a DKIM-Signature header naming your domain (d=) and a selector (s=).
Publishing: the matching public key sits in DNS at selector._domainkey.yourdomain.com.
Verifying: the receiver fetches the key, checks the signature, and records dkim=pass or dkim=fail.

Key strength matters. RFC 8301 updated DKIM so that signers "MUST use RSA keys of at least 1024 bits" and "SHOULD use RSA keys of at least 2048 bits," and ruled that the old rsa-sha1 algorithm "MUST NOT be used for signing or verifying." Google requires DKIM keys of 1024 bits or longer for mail to personal Gmail accounts and recommends 2048.

DKIM proves which domain signed a message, but not that the visible From address matches. DMARC adds that check. DKIM signatures usually survive simple forwarding, while SPF checks often fail on forwarded mail, so DKIM is the more dependable basis for DMARC alignment.

Real-World Example

In 2012, researcher Zachary Harris reported a DKIM weakness to CERT/CC. CERT/CC published vulnerability note VU#268267 on October 24, 2012, warning that keys under 1024 bits are weak and that "an attacker could factor the encryption key for a domain" and then "sign emails originating from that domain." CERT listed Google, Microsoft, and Yahoo among vendors reported to have affected domains. The fix was simple: replace short keys and stop treating test-mode signatures as trusted. The same check still applies today, because an old key published years ago can stay in DNS long after anyone remembers it.

Why It Matters for a Small Business

Most small businesses send email from several services at once: Microsoft 365 or Google Workspace, plus a CRM, an invoicing tool, a newsletter platform, and the website's contact form. Each one needs DKIM signing set up for your domain, or its mail will fail DMARC once you enforce it, and may already land in spam at Gmail. Old 1024-bit keys and selectors left behind by services you no longer use add quiet risk. DKIM is also an investigative tool: a valid signature from your domain on a fraudulent message points to a compromised account or service, not simple spoofing.

How to Spot It / How DTS Handles It

Check message headers for dkim=pass with your own domain in d=. Warning signs: mail signed only with your provider's default domain, keys shorter than 2048 bits, or no DKIM on third-party senders.

DTS can help with turning on DKIM for every service that sends as your domain, using 2048-bit keys where supported, rotating them, and removing stale selectors. See our Microsoft 365 email security service.

Related Terms

SPF: the server list that complements DKIM.
DMARC: requires DKIM or SPF to align with the From address.
Email spoofing: what DKIM helps receivers detect.
BIMI: brand logos that depend on authenticated mail.
Phishing: spoofed sender domains make phishing more convincing.
Account takeover: why a validly signed message can still be fraud.

Sources

IETF, RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (September 2011): https://www.rfc-editor.org/rfc/rfc6376
IETF, RFC 8301: Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM) (January 2018): https://www.rfc-editor.org/rfc/rfc8301
CERT/CC, VU#268267: DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust (October 24, 2012): https://www.kb.cert.org/vuls/id/268267
Google, Email sender guidelines: https://support.google.com/a/answer/81126

Last updated October 14, 2026.