{"id":30666,"date":"2022-10-20T13:51:45","date_gmt":"2022-10-20T13:51:45","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=30666"},"modified":"2025-03-07T08:48:35","modified_gmt":"2025-03-07T08:48:35","slug":"how-does-a-dkim-record-work","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/how-does-a-dkim-record-work\/","title":{"rendered":"How Does a DKIM Record Work?"},"content":{"rendered":"

So you want to know <\/span>what a DKIM record is<\/span><\/a> and how it works? DKIM is short for “DomainKeys identified Mail,” an <\/span>email authentication protocol<\/span><\/a> commonly used to place a unique digital signature on any email sent from your servers. This signature authenticates your email, letting receiving servers know the message originates from your domain and wasn\u2019t tampered with during transit.\u00a0<\/span><\/p>\n

We live in a time when cybercrime is a common occurrence. DKIM is one part of the most solid defense system you can get for your domain: DMARC<\/a>. DKIM works with SPF (Sender Policy Framework) to authenticate emails sent on your domain\u2019s behalf and <\/span>prevent spoofing<\/span><\/a> and phishing attacks.\u00a0<\/span><\/p>\n

By implementing DKIM, you’re protecting your company and the status of your brand.<\/span><\/p>\n

Before setting it up, it’s essential to understand <\/span>how DKIM works<\/b>. This protocol focuses on two central aspects: The DKIM record published in a domain\u2019s DNS (domain name system) records and the DKIM header in all emails.\u00a0<\/span><\/p>\n

This blog post discusses how DKIM works and all its moving parts that make your messages more secure.<\/p>\n

What is Public Key Cryptography?<\/b><\/h2>\n

To learn <\/span>how DKIM works<\/b>, you must first understand the meaning of public key cryptography. As the name implies, this internet security feature encrypts or signs data with a pair of cryptographic keys, one public and one private.\u00a0<\/span><\/p>\n

It’s also known as asymmetric encryption and is often used with transport layer security (TLS) and secure socket layer (SSL) certificates, which make HTTPS possible.\u00a0\u00a0<\/span><\/p>\n

Public key cryptography works with a pair of keys associated with an entity that has to verify its identity in a virtual environment. You can also use it to sign and encrypt data before sending it through the web. Public keys are meant to be published, while private keys are only known to a domain administrator.\u00a0<\/span><\/p>\n

Public key cryptography enables encryption and decryption of data. This process allows two communicating parties to keep data safe as it’s sent back and forth.\u00a0<\/span><\/p>\n

The encryption placed in the data can only be scrambled with the keys used by the data holders, making it indecipherable while in mid-transit to anyone looking to tamper with it. This prevents your data from being altered and proves to recipient servers that your email comes from an authentic source.<\/span><\/p>\n

The Two Keys of DKIM<\/b><\/h2>\n

As you learn <\/span>how DKIM works<\/b>, you\u2019ll discover that it needs two keys to work its magic. The first is a private key used to generate a digital signature by encrypting data contained in the DKIM header of an email.\u00a0\u00a0<\/span><\/p>\n

The second is a public key that\u2019s retrieved by recipient servers to verify an email. It\u2019s contained in the DKIM record of your domain\u2019s DNS.\u00a0<\/span><\/p>\n

Each time you send an email from your domain, the receiving server retrieves the public key in your domain\u2019s DKIM record. It then uses the public key to verify the DKIM signature in the email\u2019s DKIM header.\u00a0<\/span><\/p>\n

If the public key matches the encrypted digital signature, the email passes DKIM verification. If not, DKIM verification fails. The receiving server also checks whether any data in the email headers or message body was altered in transit. If not, DKIM verification passes. If data was changed, the recipient server rejects the email.<\/span><\/p>\n

What’s the Role of a DKIM Record?<\/b><\/h2>\n

Before we answer the above question, let\u2019s answer this: <\/span>What is a DKIM record?<\/span><\/a> Put simply, it\u2019s a type of DNS TXT record published in your domain\u2019s DNS and publically available to email service providers (ESPs).<\/span><\/p>\n

DKIM records play a significant role in the validation of your digital signature. The signature itself is created by a hash using various components from the message contained in any email.\u00a0<\/span><\/p>\n

Your DKIM records hold your domain’s public key, which ESPs use to compare with the private key that generates an email\u2019s digital signature.\u00a0<\/span><\/p>\n

Every email sent with a <\/span>DKIM signature<\/span><\/a> includes a DKIM header with encrypted data. Your domain is always hosted in a DNS server, which holds the DKIM record as a TXT entry. All your recipients must be able to locate this TXT record using a selector, which indicates where your domain’s public key is located.\u00a0<\/span><\/p>\n

Creating a DKIM record<\/span><\/a> and publishing it in your domain\u2019s DNS can help you look more legitimate in the eyes of your clients and business partners. With DKIM, it\u2019s much harder for bad actors to <\/span>spoof your email domain<\/span><\/a>.\u00a0<\/span><\/p>\n

DKIM also enhances your domain\u2019s reputation thanks to low spam flagging rates and higher deliverability rates.<\/span><\/p>\n

DKIM also ensures that your emails haven\u2019t tampered with mid-traffic. This is a point of contention with most ESPs.\u00a0<\/span><\/p>\n

Most of these services use TLS to encrypt messages and move them from one server to another. Still, TLS can be refuted by email servers in general, making your messages vulnerable and open to modification. DKIM keeps them safe and guarded against such events.<\/span><\/p>\n

What’s the Role of the DKIM Header?<\/b><\/h2>\n

As we mentioned, DKIM creates a digital signature by encrypting or \u2018signing\u2019 data in the mail\u2019s DKIM header. This header plays a crucial role in keeping your communications safe. Remember, DKIM headers remain attached to your email once created.\u00a0<\/span><\/p>\n

These headers are usually visually distinctive to end users if they view them.<\/p>\n

DKIM headers<\/a> are composed of a series of tags defining a specific action to validate or protect the content of your emails. To <\/span>test whether DKIM is working<\/b>, you need to understand the value of these tags and the function they fulfill in the header. The following is an example of a DKIM header:<\/span><\/p>\n

v=1; a=rsa-sha256;\u00a0<\/span><\/i><\/p>\n

d=easydmarc.com; s=big-email;<\/span><\/i><\/p>\n

h=from:to:subject;<\/span><\/i><\/p>\n

bh=4p6MxwdwXY9xGnCkOEEJJdINgzu-doeiAA=;<\/span><\/i><\/p>\n

b=7bTkT9FxgIYFJutPbxbyfsBXlbD4wJ<\/span><\/i><\/p>\n

The role of each tag in this header handles the following:<\/span><\/p>\n