DomainKeys Identified Mail (DKIM)

DomainKeys Identified Mail (DKIM) is a method of email authentication that lets the receiving mail server confirm two things — that a message was genuinely authorized by the domain it claims to come from, and that its key content was not altered on the way. The sending system attaches a cryptographic signature to the message header, generated with a private key held by the domain. The receiver looks up the matching public key, published in the domain's DNS records, and checks the signature. If it verifies, the receiver knows the message was signed by someone who controls that domain and that the signed parts arrived intact. DKIM does not encrypt the message or prove who the human sender is — it ties the message to the domain and guarantees integrity. It is one of three core email-authentication standards, alongside SPF and DMARC.

DKIM matters because email was not built with sender verification, which made forgery and spoofing easy and gave phishing and spam an open door. By letting receivers cryptographically confirm that a message was authorized by its domain and unchanged, DKIM raises the cost of impersonating a brand and helps legitimate senders prove they are who they say they are. Mailbox providers weigh authentication results when deciding whether a message reaches the inbox, the spam folder, or nowhere, so DKIM is now a practical deliverability requirement, not just a security nicety. A brand that signs its mail with DKIM, aligns it with its domain, and pairs it with SPF and DMARC is far more likely to land in the inbox and far harder to impersonate.

DKIM is best understood next to the other two authentication standards it works with. SPF (Sender Policy Framework) publishes a list of the servers allowed to send mail for a domain, so the receiver can check whether a message came from an authorized source. DKIM, by contrast, attaches a cryptographic signature that proves the message was authorized by the domain and not altered — it verifies the content and the signing domain, not just the sending server. The two cover different ground: SPF checks the path, DKIM checks the signature and integrity. Neither alone tells the receiver what to do when a check fails, and neither alone guarantees the visible From address matches the authenticated domain. That is the gap DMARC fills.

DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of SPF and DKIM. It requires that the authenticated domain align with the visible From domain, and it lets the domain owner publish a policy telling receivers what to do with messages that fail — accept, quarantine, or reject — plus receive reports on who is sending mail in their name. So the three are layered, not interchangeable: SPF authorizes sending servers, DKIM signs and protects the message, and DMARC ties them to the From address and sets the policy. Strong email authentication uses all three together. DKIM is the integrity-and-signature layer, the piece that proves a specific message was authorized by the domain and unchanged, which is why it is one of the pillars of inbox trust.

Using DKIM well means signing all of your outbound mail with a key tied to your sending domain, publishing the matching public key in DNS, and keeping the key rotated and adequately strong. It means aligning DKIM with the visible From domain so it satisfies DMARC, and configuring it for every service that sends mail in your name — your email platform, marketing tool, support system, and any third party — so none of your legitimate streams go unsigned. It means monitoring authentication results and DMARC reports to catch streams that fail and senders impersonating you. Treated this way, DKIM is part of an authentication program rather than a one-time setting, and it directly supports deliverability because mailbox providers reward consistently authenticated, aligned mail.

The failures are signing only some streams (so legitimate mail from a forgotten service fails and lands in spam), letting keys go stale or weak, failing to align DKIM with the From domain (so DMARC still fails despite a valid signature), and treating DKIM as a security checkbox rather than a deliverability and anti-impersonation tool. Another trap is assuming DKIM alone stops phishing — it proves a message was authorized by a domain and unaltered, but without DMARC enforcement an attacker can still spoof your visible From address using a domain you do not control. The discipline is to deploy DKIM across every sending source, align it, enforce it with DMARC, and monitor the results.

DomainKeys Identified Mail (DKIM) — a cryptographic signature proving a message was authorized by its domain and unaltered — is one of the three pillars of email authentication, working with SPF and DMARC.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where domainkeys identified mail (dkim) is a core concern: