Key takeaways
- DKIM lets a receiver verify a signature associated with a sending domain.
- A signature authenticates specified message material; it does not encrypt the content.
- Check the actual signing domain and DMARC alignment for every legitimate service.
Overview
The signature covers selected headers and message content according to its parameters. It can help detect changes to signed material in transit, but a valid signature does not establish that the message is wanted or harmless. The signing domain may differ from the visible From domain; DMARC alignment determines whether that relationship satisfies the sender’s policy.
How it works
Configure the sending service to sign messages for an appropriate domain.
Publish the corresponding public key at the required DNS selector.
Verify received signatures and maintain keys and selectors as services change.
Understand the signature and selector
A sending service signs selected message material using a private key. The receiver uses the signing domain and selector from the signature to find the corresponding public key in DNS and verify it. The selector allows a domain to publish keys for different services or key changes without assuming every message uses the same key.
The private key belongs in the sending system, while the public key is intended to be published. DKIM is not message encryption: the content can still be readable to systems handling the mail. A valid signature also does not establish that the message’s claims are true or that the recipient wants it.
| Component | Purpose | Operational check |
|---|---|---|
| Signing domain | Identifies the domain taking responsibility | Does it align appropriately with the visible author? |
| Selector | Locates the published verification key | Does DNS expose the key the service expects? |
| Signature | Allows verification of signed material | Does the received message verify after transit? |
| Private key | Creates signatures in the sending system | Is access controlled and the key lifecycle managed? |
Source material: IETF / RFC Editor — RFC 6376: DomainKeys Identified Mail ↓
Configure and verify each mail stream
Employee mail, support replies and product notifications may use different signing services. Inventory them and follow the current provider instructions for domain setup. A domain can have a valid DKIM key while a particular service still sends unsigned messages or signs under a provider-owned domain that does not meet the intended alignment policy.
Test actual received messages after changes. Inspect the signing domain, selector and authentication result, then check DMARC separately. A DNS checker can confirm key publication but cannot prove that a service is applying the expected signature to every message type or that later transformations preserve it.
Manage changes without breaking legitimate mail
Coordinate key changes with the sending service and account for messages already in transit. Removing a public key too early can prevent receivers from verifying mail signed with the old key. The correct overlap and rotation procedure depend on the provider and operating environment, so use its documented process rather than a universal timing rule.
An illustrative message template change adds a downstream system that modifies signed content. DKIM failures then appear only for that path. Investigate where the message changes and which material was signed instead of replacing keys blindly. Track failure rates by service and selector so one broken stream does not disappear inside the overall email volume.
What this looks like in practice
A company’s email platform signs a message with its configured domain. The recipient retrieves the selector’s public key and checks the signature before evaluating alignment and other filtering signals.
Examples explain the concept; they are not reported customer results.What to check
Inspect actual received headers, signing-domain alignment and failure rates. Confirm that legitimate transformations do not unexpectedly invalidate signatures.
Common mistake
Treating a DKIM pass as proof that the sender is reputable or that the email’s claims and links are safe.
DomainKeys Identified Mail vs. Sender Policy Framework
DKIM validates a domain-linked message signature. SPF checks authorized sending infrastructure. A message can pass one and fail the other, so both results need context.
Read the Sender Policy Framework definition →Questions answered
What is DomainKeys Identified Mail?
DomainKeys Identified Mail, or DKIM, authenticates a domain’s responsibility for an email using a digital signature that a receiving server verifies with a public key published in DNS.
Does DKIM hide the message from intermediaries?
No. It is a signature mechanism, not content encryption. Transport security and end-to-end encryption are separate topics.
Can a message be signed by more than one domain?
Yes. Multiple signatures are possible. DMARC evaluation considers whether a passing signature aligns appropriately with the visible From domain.
Can DKIM survive forwarding?
It can when the signed material remains compatible with verification, because the check does not rely on the forwarding IP in the same way as SPF. Some forwarding or mailing-list transformations can alter signed content and cause failure. Inspect the actual path and received headers.
Does a DKIM pass prove the visible From domain is authenticated?
Not by itself. The signing domain can differ from the visible author domain. DMARC evaluates whether a passing signature aligns under the applicable policy. Check the domain relationship rather than assuming any passing signature establishes the identity shown to the recipient.
References and further reading
Primary documentation and source material for this topic. Sources checked September 14, 2026; provider requirements can change.
- RFC 6376: DomainKeys Identified Mail ↗IETF / RFC Editor
- RFC 9989: DMARC ↗IETF / RFC Editor
Current DMARC specification; replaces RFC 7489 together with the separate reporting specifications.
- Email sender guidelines ↗Google
Continue reading on the blog
- Email verification and deliverability in outbound workflows →
- Personalize outreach with supporting evidence →
Put the concept to work.
Explore the relevant AstroFabric workflow and see how the pieces connect.
Help keep this guide useful. Suggest a correction or browse the full glossary.