What is DKIM (DomainKeys Identified Mail)?

DKIM (DomainKeys Identified Mail) is an email authentication method in which the sending server signs selected headers and the body of each message with a private key, and publishes the matching public key in DNS at selector._domainkey.domain. A receiver fetches the key and verifies the signature, proving the message was authorised by the domain and not altered in transit. DKIM is defined in RFC 6376.

What a DKIM signature looks like

A signed message carries a DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail2026;
  h=from:to:subject:date; bh=...; b=...

d= is the signing domain, s= is the selector, h= lists the signed headers, bh= is the body hash and b= is the signature. The receiver fetches the TXT record at mail2026._domainkey.example.com, reads the public key from its p= tag, and checks the signature.

Selectors and rotation

A selector is a label that lets a domain publish several keys at once. Providers use them to rotate keys without downtime: publish a new selector, switch signing to it, then remove the old record. Google Workspace uses google, Microsoft 365 uses selector1 and selector2. The DKIM checker scans common selectors if you do not know yours.

Key size

RFC 8301 requires verifiers to support 2048-bit RSA and lets them refuse keys under 1024 bits. Keys of 512 bits have been factored with rented compute; do not publish them. Ed25519 keys (RFC 8463) are shorter and stronger but not every receiver verifies them yet, so publish an RSA key alongside.

Why DKIM survives forwarding and SPF does not

The signature travels inside the message, so a forwarded copy still verifies as long as the forwarder did not modify the signed parts. SPF is tied to the connecting IP and fails the moment a third party forwards the mail. That difference is why DMARC passes on either.

DKIM and Spamjadoo

DKIM can only be verified after the body arrives, so it cannot drive a handshake rejection. Spamjadoo verifies it on the traffic that survives the protocol checks and uses the result for DMARC alignment and for per-domain policy.

Last reviewed 10 September 2026 by Spamjadoo engineering.