{"id":30732,"date":"2022-10-26T14:01:25","date_gmt":"2022-10-26T14:01:25","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=30732"},"modified":"2025-07-30T13:25:59","modified_gmt":"2025-07-30T13:25:59","slug":"dkim-another-step-to-dmarc-compliance","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/dkim-another-step-to-dmarc-compliance\/","title":{"rendered":"DKIM: Another Step to DMARC Compliance"},"content":{"rendered":"

If you’re heading a business with a solid online presence, achieving <\/span>DMARC compliance<\/b> should be your primary goal. DMARC is an authentication protocol applied to your domain so only authorized sources can send emails on your behalf.\u00a0<\/span><\/p>\n

This is important if you want to be known as a reputed sender and increase your profile as a respected brand on the Internet. DMARC not only prevents malicious actors from sending fraudulent, spam, spoofed, or <\/span>phishing emails<\/span><\/a> in your company\u2019s name, but it also improves deliverability rates of your legitimate emails.\u00a0<\/span><\/p>\n

When it comes to <\/span>DMARC vs. DKIM<\/span> or even <\/span>DKIM vs. SPF<\/span>, there\u2019s really no true comparison. All three protocols are unique <\/span>email authentication<\/span><\/a> standards working differently but all requiring correctly configured DNS records.<\/span><\/p>\n

SPF is the first step<\/span><\/a> towards DMARC compliance. It\u2019s a protocol that allows you to specify which IP addresses and third-party entities are authorized to send emails on your behalf.\u00a0<\/span><\/p>\n

DKIM<\/span><\/a> is an equally vital step. It allows you to digitally sign your emails with a cryptographic key, ensuring only unaltered and authentic emails are sent on your domain\u2019s behalf.<\/span><\/p>\n

DMARC enhances both of these standards and offers unrivaled email domain security and fraud prevention through SPF\/DKIM authentication and alignment. But reaching 100% <\/span>DMARC compliance <\/b>is a process.\u00a0<\/span><\/p>\n

In this blog post, we discuss what’s required to achieve <\/span>DMARC compliance<\/b>, what it is, and the role DKIM plays. There’s more to it than simply <\/span>adding a DKIM record to your DNS<\/span><\/a>. Ready? Let\u2019s jump in.<\/span><\/p>\n

DMARC Compliance: What is it Built on?<\/b><\/h2>\n

To learn why <\/span>DMARC compliance<\/b> is so important, it helps to understand the basics of DMARC itself. It\u2019s an anti-spoofing protocol that authenticates your email sending domain, allowing only verified emails to enter the recipient\u2019s inbox. DMARC relies upon both SPF and DKIM<\/a>. But implementation on its own doesn\u2019t suffice.<\/span><\/p>\n

SPF or the Sender Policy Framework authenticates emails by verifying whether a sender is authorized. That\u2019s where the SPF record comes in. It\u2019s a TXT record, which is a <\/span>type of DNS record<\/span><\/a> containing the list of IP addresses and third parties allowed to send emails on behalf of your company\u2019s domain.<\/span><\/p>\n

DKIM is short for DomainKeys Identified Mail. It validates emails and verifies their authenticity using a cryptographic key pair\u2014one private and one public. The private key is used to generate an encrypted digital signature for every message sent from your website’s domain.\u00a0<\/span><\/p>\n

The public key is included in a domain\u2019s DNS records as a modified TXT record, known as a DKIM record. It\u2019s used by receiving senders to match the digital signature and authenticate a message.<\/span><\/p>\n

When an email is sent, SPF uses the return-path address, while DKIM uses the DKIM signature header for verification checks. But neither use the visible \u201cFrom:\u201d address, meaning malicious actors can still use a fake \u201cFrom:\u201d address to scam recipients.<\/span><\/p>\n

Enter DMARC. It requires the \u201cFrom:\u201d address to match the DKIM signature header domain (for DKIM) or the return-path domain (for SPF). Essentially, that\u2019s what DMARC alignment is\u2014ensuring the \u201cFrom:\u201d field contains a verified domain.<\/span><\/p>\n

DMARC compliance <\/b>requires an email to pass SPF or DKIM authentication <\/span>and <\/span><\/i>the return-path or DKIM header to match the \u201cFrom:\u201d address.\u00a0<\/span><\/p>\n

In other words, an email can only achieve <\/span>DMARC compliance<\/b> after SPF or DKIM authentication and alignment.<\/span><\/p>\n

What’s DKIM’s Role in DMARC Compliance?<\/b><\/h2>\n

Understanding a <\/span>DKIM signature<\/span><\/a> and knowing <\/span>how a DKIM record works<\/span> can help answer this question.<\/span><\/p>\n

When an inbound server receives an email, it retrieves the DKIM record of the domain cited as the sender. It then locates the public key and uses it to decrypt and match the digital DKIM signature (that was generated by the private key) in the email.<\/span><\/p>\n

If the DKIM signature matches the public key contained in the DKIM record, then the email passes DKIM authentication.<\/span><\/p>\n

Alignment is the second stage. In this process, the receiving server checks if the domain in the email\u2019s “From:” header that’s visible to the receiver matches the “d=” tag domain used in the DKIM header.<\/span><\/p>\n

If you want your emails to achieve full <\/span>DMARC compliance<\/b>, authentication and alignment must pass flawlessly. Both verification procedures look at the primary domain and how it syncs with any other subdomains you might have. That\u2019s why it\u2019s crucial to <\/span>create a DKIM record<\/span><\/a> for every domain or subdomain authorized to send email on your company\u2019s behalf.<\/span><\/p>\n

Syntax plays a prominent role in getting DKIM right. If you’re unsure how to handle a DKIM record properly, ask a professional for help. EasyDMARC has a team of specialists ready to configure your DKIM record to be 100% DMARC compliant. By going this route, you’ll avoid mistakes and risks of getting error messages or bounced emails.<\/span><\/p>\n

DMARC Alignment: When SPF and DKIM Come Together<\/b><\/h2>\n

Essentially, implementing SPF and DKIM<\/a> to achieve DMARC compliance is the best way to tell recipient servers precisely how to handle emails sent on your company\u2019s behalf.<\/span><\/p>\n

This way, you have control over how recipient servers determine whether an email should be delivered to the inbox or not. When an email is sent, the receiving server checks which DNS records are stored for the associated domain.\u00a0<\/span><\/p>\n

When a DMARC record is found, the receiving server then proceeds to check the message being sent based on the policies dictated by SPF and DKIM.<\/span><\/p>\n