DKIM Explained (2024)

With the increasing sophistication of email scams, phishing attacks, and impersonation, ensuring the authenticity of email senders and protecting against fraud has become more critical than ever.

This is where DKIM (DomainKeys Identified Mail) comes into play. DKIM is an email authentication method that adds a digital signature to each email, allowing recipients to verify the sender’s identity and ensuring the integrity of the message.

In this blog post, we will explore DKIM in detail, including its working mechanism, implementation, and its role in enhancing email security.

What is DKIM?

DKIM, short for DomainKeys Identified Mail, is an email authentication protocol that adds a digital signature to each email sent from a domain. This signature acts as a unique identifier for the email, allowing recipients to verify that the message indeed comes from the claimed domain.

By using DKIM, email recipients can be confident that the email was not altered during transit and that it originates from a trusted domain, helping to prevent phishing attacks and email fraud.

How Does DKIM Work?

DKIM works through the use of cryptographic authentication to ensure the authenticity of the sender’s domain.

When an email is sent from a domain that has DKIM implemented, the outgoing email server generates a unique DKIM signature header for the message.

This header contains two cryptographic hashes—one for specified headers and another for the message body or a part of it. The header also includes information about how the signature was generated.

The DKIM signature is created using a private DKIM key, which is accessible only to the sender’s email server. The signature is then encrypted and added to the email headers as a unique identifier of the message.

When the email reaches the recipient’s server or mailbox provider, it verifies the DKIM signature using the corresponding public DKIM key stored in the DNS as a DKIM record.

If the verification is successful, the email passes DKIM and is considered authentic and unaltered. If the verification fails, the recipient’s server can take appropriate actions based on the domain’s DMARC policy.

Implementing DKIM: Creating a DKIM DNS Record

To implement DKIM for your domain, you will need to create a DKIM DNS record that contains the public key used to verify DKIM signatures. Here are the steps to create a DKIM DNS record:

Generate a Public/Private Key Pair: First, you need to generate a public/private key pair. You can use tools like the DKIM Generator from EasyDMARC or other DKIM key generation tools.
Obtain the Public Key: From the key pair, obtain the public key that will be used to verify the DKIM signatures.
Find the DKIM Selector: The DKIM selector is a unique identifier that helps locate the appropriate public key for verification. The selector is inserted into the DKIM-Signature email header when the email is sent. It is often an alphanumeric string formed with random characters, and it is specified when you create the key pair.
Create the DKIM DNS Record: The DKIM DNS record is a TXT record that contains the necessary information, including the domain name of the email sender, the DKIM signature type (DKIM1), the algorithm used (rsa), and the public key used to verify the signature. The record should look something like this:

dkim.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfT7/x8l746u2k57u
...

Publish the DKIM Record: Log in to your DNS hosting provider’s website and add the DKIM DNS record to your domain’s DNS zone.

Once the DKIM record is published, it may take up to 24 hours to propagate throughout the internet. After propagation, DKIM-enabled email servers will be able to verify the authenticity of emails sent from your domain.

The Difference Between DKIM and SPF

DKIM and SPF are both email authentication protocols that work to verify the authenticity of email senders, but they do so in different ways.

SPF (Sender Policy Framework):

SPF verifies email senders based on a list of authorized sources specified in the SPF record.
SPF checks the IP address of the sending server against the authorized list to determine if the email is legitimate.
SPF has limitations in preventing domain spoofing on its own.
SPF does not provide encryption or cryptographic authentication.

DKIM (DomainKeys Identified Mail):

DKIM uses public-key cryptography to authenticate email senders.
DKIM adds a digital signature to each email as a unique identifier.
The signature is generated using a private DKIM key and can be verified using the corresponding public DKIM key.
DKIM also verifies that the email hasn’t been tampered with during transit.
DKIM is a stronger authentication method compared to SPF because it uses public-key cryptography instead of IP addresses.

Both DKIM and SPF are essential components of email authentication and are often used together, along with DMARC (Domain-based Message Authentication, Reporting, and Conformance), to enhance email security and deliverability.

Can I Use DKIM Without SPF?

Yes, it is possible to use DKIM without SPF. DKIM and SPF are independent protocols that serve different purposes in email authentication. While SPF verifies email senders based on a list of authorized sources specified in the SPF record, DKIM adds a digital signature to each email for authentication and verification. DKIM ensures the integrity of the email and verifies its source, while SPF focuses on checking the IP address of the sending server against an authorized list.

However, while using DKIM alone can improve email security, it is highly recommended to use both DKIM and SPF together, along with DMARC. Combining these email authentication technologies provides a robust defense against phishing attacks, domain spoofing, and impersonation, ultimately increasing email deliverability and protecting employees and customers from targeted email attacks.

How Does DKIM Relate to DMARC?

DKIM and DMARC are both email authentication protocols that work in conjunction to improve email security and deliverability. While DKIM verifies the authenticity of emails using cryptographic authentication, DMARC utilizes SPF and/or DKIM records to authenticate emails and allows domain owners to monitor and control what happens to unauthenticated emails sent from their domain.

Here are some key points on how DKIM relates to DMARC:

DKIM is one of the authentication methods that DMARC can use to verify the authenticity of emails.
DMARC depends on both SPF and DKIM to authenticate email.
DMARC defines a process for handling unauthorized or unauthenticated messages based on SPF and DKIM results.
DMARC enables domain owners to specify how receiving servers should handle unauthorized or unauthenticated messages.
DMARC defines another DNS record, the DMARC record, which specifies the domain’s DMARC policy and references SPF and/or DKIM records.

In summary, DKIM and DM

ARC work together to enhance email security and deliverability. While DKIM verifies the authenticity of emails using cryptographic authentication, DMARC provides a framework for handling unauthenticated emails and gives domain owners greater control over their email ecosystem.

What is a DKIM Selector?

A DKIM selector is a crucial element of DKIM implementation that facilitates locating the private key used to sign the email and the public key used for verification. It acts as a unique identifier and is inserted into the DKIM-Signature email header as an s= tag when the email is sent.

The selector can be an alphanumeric string formed with random characters, providing individual source names, server locations, and signing dates. In scenarios where multiple DKIM records or keys are used for a single domain, the selector becomes especially necessary.

When a user creates a private/public key pair using an email delivery service like SendGrid, they specify the selector to identify the appropriate keys.

To find the DKIM selector for your domain, you can send an email to yourself and view the “original message” or “full headers” of the email.

How Can I Find the DKIM Selector for My Domain?

There are several methods to find the DKIM selector for your domain:

Use a DKIM Lookup Tool: Utilize a DKIM lookup tool like EasyDMARC to find the DKIM selector for your domain. Open the console or command line on your computer and type “dig ._domainkey. TXT,” where represents the DKIM selector and denotes the domain name. Upon execution, the output will display the DKIM record for the domain, including the public key and other relevant information.
Check the DKIM Signature in the Email Header: The DKIM selector is inserted into the DKIM-Signature email header as an s= tag when the email is sent. You can send an email to yourself and view the “original message” or “full headers” of the email to find the DKIM selector. Search the headers for “DKIM-signature” to locate the DKIM signature applied to the message. The DKIM selector is part of the signature, indicated by the ‘s=’ tag.
Use a DMARC Tool: Consider using a DMARC tool like PowerDMARC or DMARCLY to find the DKIM selector for your domain. On the PowerDMARC control panel, go to DMARC aggregate reports and select your desired view. Locate the row of the sending source for which you want to view your DKIM selector, and you will find the selector displayed. In DMARCLY, when asked for the DKIM selectors on a domain, you can view the DKIM selector in the DKIM record.

Reusing a DKIM Selector for Multiple Domains

Yes, you can reuse a DKIM selector for multiple domains. However, keep in mind that one domain can only have one public key associated with a DKIM selector.

This means that using the same DKIM selector for multiple domains will all share the same public key.

While this approach might be convenient, it also poses a security risk as compromising one of the domains could affect the others.

On the other hand, having multiple DKIM records on a single domain is possible by creating multiple DKIM selectors on that domain, with each selector pointing to a different DKIM record. This is particularly useful in scenarios where you use multiple third-party email vendors for your daily communications.

Conclusion

In today’s digital landscape, email security is of paramount importance, and DKIM plays a crucial role in enhancing email authentication and protecting against fraudulent activities. By adding digital signatures to emails and utilizing cryptographic authentication, DKIM enables recipients to verify the authenticity of email senders and ensure the integrity of messages.

Implementing DKIM involves creating a DKIM DNS record containing the public key used for verification. Alongside other email authentication protocols like SPF and DMARC, DKIM forms a comprehensive email security strategy that safeguards both senders and recipients from various email threats.

With a better understanding of DKIM and its workings, you can now take the necessary steps to implement this essential email authentication protocol for your domain, ultimately contributing to a safer and more secure email ecosystem.

So, the next time you send or receive an email, remember that DKIM is quietly working in the background to keep you safe from email fraudsters and impostors.