DKIM
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every email you send. Receivers verify the signature against a public key you publish in DNS. If the message was altered or forged, the signature breaks. SPF authorises who can send; DKIM proves what was sent. Specified in RFC 6376, with crypto parameters updated by RFC 8301.
How it works
Two halves of the same handshake: the sender signs every outgoing message, the receiver verifies the signature against a public key in DNS. If the hashes match, the message is authentic and unmodified.
- 01hash selected headers (From, To, Subject, Date) + body
- 02sign the hash with your private key
- 03attach the signature as a DKIM-Signature header
- 01read DKIM-Signature: pull s= (selector) and d= (domain)
- 02query DNS: <selector>._domainkey.<domain> TXT
- 03re-hash the message, verify against the public key
- 04match ⇒ message authentic. mismatch ⇒ rejected.
Where the public key lives
As a TXT record at a specific DNS path:
<selector>._domainkey.yourdomain.comThree parts:
- Selector: a label your provider chooses. Google Workspace uses
google. Microsoft 365 usesselector1andselector2. Mailgun usespdk1andpdk2. Postmark uses timestamped selectors ending inpm. One domain can have many active selectors, one per service that signs your mail. _domainkey: required by the DKIM spec (RFC 6376 §3.6.2.1). Always exactly this string.- Your domain: the root domain being signed.
A typical record at that path:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...The p= value is the base64-encoded public key. The matching private key lives with your provider.
Anatomy of a signature
The DKIM-Signature header travels with every signed message. Each tag plays a specific role.
always 1. The only version defined.
signing algorithm. rsa-sha1 is prohibited by RFC 8301; rsa-sha256 and ed25519-sha256 are valid.
how whitespace is normalised before hashing. Relaxed is forgiving; simple is strict.
signing domain. Must align with the From: for DMARC to pass.
points the receiver at <selector>._domainkey.<domain> for the public key.
which headers are covered. Any change to these in transit breaks the signature.
hash of the message body. Detects body tampering.
the RSA or Ed25519 signature itself. Base64 encoded.
Detection
DKIM has no directory. An external scanner cannot list every selector a domain uses. Sudory probes the sixteen most common selector names in parallel. One match means DKIM is live.
Sudory marks DKIM pass when any probed selector returns a v=DKIM1 record. If nothing matches, Sudory marks warn rather than fail. Missing from our probe list does not prove missing overall; your provider may use a custom name.
Setting it up
Every mainstream provider has a one-click DKIM flow. Same pattern everywhere.
| Provider | Where | Selector |
|---|---|---|
| Google Workspace | Admin console → Apps → Gmail → Authenticate email | s=google |
| Microsoft 365 | Defender portal → Email & collaboration → Email authentication settings → DKIM | s=selector1 and s=selector2 |
| Postmark | Sender signatures → Add domain → DKIM tab | Timestamped, ends in pm (e.g. s=20240101pm) |
| SendGrid | Sender Authentication → Domain Authentication | s=s1, s=s2 (rotated) |
| Mailgun | Sending → Domain settings → DNS records | s=pdk1, s=pdk2 |
The provider generates a key pair, gives you the public key, you publish the TXT record, they verify, they switch signing on.
Common mistakes
- Keys rotated, DNS not updated. Providers rotate keys on a schedule. If your DNS still points to an old selector, signatures stop verifying.
- Weak crypto. RFC 8301 bans
rsa-sha1: receivers MUST NOT treat those signatures as valid. RSA keys must be 1024 bits or more; 2048 is recommended. Modern providers default torsa-sha256and 2048-bit keys. Older on-premises appliances still producersa-sha1; those fail today. - Only some traffic signed. Each sending service needs its own selector. Postmark, Mailchimp, and SendGrid all run separate key pairs.
- TXT record split badly. Base64 keys exceed the 255-character TXT limit. DNS allows concatenating quoted chunks, but some providers do not expose the option.
Check which selectors respond on your domain: scan your domain. Sudory probes all sixteen and reports every match.
