DKIM (DomainKeys Identified Mail) is a way for a sending server to sign each email with a cryptographic key, so the receiving server can check two things: the message really was authorised by the domain that signed it, and it was not changed on the way.
If SPF is a list of servers allowed to send for your domain, DKIM is a tamper-evident seal on each individual message.
How DKIM works, step by step
- You create a key pair: a private key that stays on your mail server, and a public key that you publish in DNS.
- When your server sends a message, it computes a hash of the body and of chosen headers, then signs that hash with the private key.
- The result is added to the message as a
DKIM-Signatureheader. - The receiving server reads the
d=(domain) ands=(selector) values from that header, looks up the public key in your DNS, and uses it to verify the signature. - If the signature checks out, the message passes DKIM. If the body or a signed header was altered, or the key does not match, it fails.
Anatomy of a DKIM signature
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=yourdomain.com; s=mail2026;
h=from:to:subject:date:message-id;
bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
b=AuUoFEfDxTDkHlLXSZEpZj79LICEps6eda7W3deTVF...| Tag | Meaning |
|---|---|
d= | The domain that signed the message |
s= | The selector, which picks the right key in DNS |
h= | Which headers are covered by the signature |
bh= | Hash of the message body |
b= | The signature itself |
a= | The algorithm, normally rsa-sha256 |
The DNS record
The public key is published as a TXT record at selector._domainkey.yourdomain.com. For the signature above that is mail2026._domainkey.yourdomain.com:
mail2026._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."The long p= value is the public key. A 2048-bit RSA key is the sensible size today; 1024-bit is still accepted by many receivers but is considered weak. A 2048-bit key is longer than one DNS string allows (255 characters), so it is split into several quoted chunks. Most DNS providers handle the splitting for you, but some need you to paste it as one value and will split it themselves. If your key looks truncated when you re-read it, that is the first thing to check.
What DKIM does and does not do
DKIM does survive forwarding, because the signature travels with the message and does not depend on which server delivers it. It proves the signing domain vouches for the message, and it lets receivers build a reputation for that domain over time.
DKIM does not by itself prove the visible From address is genuine. A scammer can sign a message with their own domain's key and still put your address in the From line. DMARC fixes this by requiring the DKIM (or SPF) domain to align with the From domain.
DKIM also does not encrypt anything. It signs; it does not hide the content.
Common DKIM problems
- "DKIM not found" or "no key for signature". The record is at the wrong name. The selector in the message must match the label in front of
._domainkey. Some DNS panels append the domain automatically, which producesmail2026._domainkey.yourdomain.com.yourdomain.comif you type the full name. - "Body hash did not verify". Something modified the message after signing, such as a mailing list adding a footer, a security gateway rewriting links, or a disclaimer appended by a relay.
- Signature fails after a key change. You replaced the key in DNS but the server still signs with the old one, or the old record is still cached. See DKIM selectors and key rotation for the safe way to change keys.
- Two services signing with the same selector. Each sender should use its own selector.
How to set up DKIM
If you run your own server you need OpenDKIM or a similar signer, a key per domain, and the DNS record. If you use a hosted service, it generates the key and tells you which record to publish. Either way the steps are the same: generate the key pair, publish the public half, turn on signing, then send a test message and confirm the result in the headers. Our guide how to check SPF, DKIM and DMARC for any domain shows what a pass looks like.
How Mailions handles DKIM
Adding a domain in Mailions creates a dedicated DKIM key for that domain. The private key is stored encrypted at rest, and the panel shows the exact TXT record to publish at your DNS provider. Once you publish it, the DNS check confirms the record is live before you start sending. There is nothing to generate by hand and no shared key between customers.