DKIM Record Email Auth

DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was sent by an authorized server and hasn't been tampered with in transit. The public key used to verify these signatures is published in a DNS TXT record.

What Is a DKIM Record?

A DKIM record publishes a public cryptographic key in DNS. When your mail server sends an email, it creates a digital signature using a private key. The receiving server retrieves the public key from your DKIM record to verify the signature.

If the signature is valid, the receiving server knows:

• The email was sent by a server with access to the private key
• The email headers and body haven't been modified
• The domain in the signature matches the sending domain

DKIM Record Format

DKIM records are stored at a special subdomain combining the selector and "_domainkey":

selector._domainkey.example.com.    3600    IN    TXT    "v=DKIM1; k=rsa; p=MIIBIjAN..."

DKIM record components:

google._domainkey.example.com.    3600    IN    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1234..."

Understanding DKIM Selectors

A selector is an identifier that allows multiple DKIM keys for one domain. This is useful for:

• Multiple services — Different selectors for Gmail, SendGrid, Mailchimp, etc.
• Key rotation — Deploy new keys without breaking existing signatures
• Different departments — Separate keys for marketing vs. transactional email

Common Selector Examples

google._domainkey.example.com     → Google Workspace
s1._domainkey.example.com         → Generic selector 1
selector1._domainkey.example.com  → Microsoft 365
k1._domainkey.example.com         → Mailchimp
mail._domainkey.example.com       → Custom mail server

How DKIM Works

1. Signing — Your mail server creates a hash of the email content and signs it with the private key
2. Header addition — The signature is added to the email's "DKIM-Signature" header
3. DNS lookup — The receiving server extracts the selector and domain, then queries DNS for the public key
4. Verification — The receiver uses the public key to verify the signature matches the email content

DKIM Signature Header

When you receive a DKIM-signed email, the header looks like:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=example.com; s=google;
  h=from:to:subject:date:message-id;
  bh=2jUSOH9NhtVGCQW...;
  b=dzdVyOfAKCdLXd...

Setting Up DKIM

1. Generate Key Pair

Most email services provide DKIM keys automatically. For custom setups:

# Generate 2048-bit RSA key pair
openssl genrsa -out dkim.private 2048
openssl rsa -in dkim.private -pubout -out dkim.public

2. Publish DNS Record

Add the public key to DNS:

selector._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjAN..."

3. Configure Mail Server

Configure your mail server to sign outgoing messages with the private key.

DKIM Key Sizes

DKIM Best Practices

• Use 2048-bit keys — Provides good security while fitting in DNS records.
• Rotate keys periodically — Change keys every 6-12 months for security.
• Use unique selectors per service — Makes troubleshooting easier and limits blast radius if compromised.
• Keep private keys secure — Never share or expose your private key.
• Test before enforcement — Use t=y flag during testing.
• Implement DMARC — DKIM works best alongside SPF and DMARC.

Troubleshooting DKIM

Common issues and solutions:

• DKIM verification failing — Check that the selector in the signature matches the DNS record name.
• Record not found — Verify the complete record name: selector._domainkey.domain.com
• Signature mismatch — Email may have been modified in transit, or there's a key mismatch.
• Key too long for DNS — Split large keys across multiple strings in the TXT record.
• Canonicalization issues — Try "relaxed" canonicalization if "simple" fails.

Related Record Types

• TXT Record — DKIM records are stored as TXT records
• SPF Record — Email sender authorization
• DMARC Record — Email authentication policy
• MX Record — Mail server configuration