DKIM is an email authentication standard in which the sending domain adds a cryptographic signature to each message, which receivers verify against a public key published in DNS.
DomainKeys Identified Mail is defined in RFC 6376. The sending system signs selected headers and the body of a message with a private key and adds a DKIM-Signature header naming the signing domain (d=) and a selector (s=). The receiver looks up the public key at <selector>._domainkey.<domain> and checks that the message was not altered and that the signing domain takes responsibility for it.
A valid DKIM signature proves which domain signed a message, not that the message is honest or that the signer is the domain shown in the From line. DMARC adds that link by requiring the signing domain to align with the visible From domain.
In practice
DKIM matters for brand protection because, together with SPF and an enforced DMARC policy, it lets receivers reject emails that spoof your domain. When documenting a phishing or impersonation campaign, the DKIM signing domain in the message headers is useful evidence of which domain and sending service were used, which tells you where to send an abuse report.
Source: RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures ↗
Related removals
- Brand protection — Custom engagement, pay on success
Related terms
- SPF (Sender Policy Framework) — SPF is an email authentication standard in which a domain publishes, in DNS, the list of servers allowed to send email on its behalf.
- DMARC — DMARC is an email authentication standard that lets a domain owner tell receiving servers what to do with mail that falsely uses its domain in the From address, and receive reports about it.
- Phishing — Phishing is a fraud in which attackers impersonate a trusted brand or person, by email, text or a fake website, to trick people into handing over passwords, payment details or money.
- Abuse report — An abuse report is a complaint to a hosting provider, domain registrar, CDN or email provider that its service is being used for phishing, fraud, malware or other illegal activity.