DKIM

DKIM (DomainKeys Identified Mail) is an email authentication standard that adds a cryptographic signature to outgoing messages, allowing receiving mail servers to verify that the email came from the domain it claims and was not altered during delivery.

What DKIM Means in Marketing

An email can be intercepted and modified in transit. DKIM is the mechanism that makes such tampering detectable.

When you send an email, your mail server uses a private key to generate a digital signature of specific parts of the message: typically the headers and body. That signature is embedded in the email header. The corresponding public key is published in your domain’s DNS records. When the email arrives at Gmail or Outlook, their servers look up your public key, use it to check the signature and verify two things: the message came from a server with access to your private key, and the message content has not been changed since it was signed.

For marketers, DKIM is part of the authentication foundation that inbox providers require. Without it, mail is more likely to be spam-filtered, and DMARC policies that protect your brand from phishing cannot be fully enforced.

How DKIM Works

The signing process:

When your mail server sends an email, it hashes the message content and encrypts the hash using your domain’s private DKIM key. The encrypted hash, called the signature, is added as a DKIM-Signature header to the email.

The verification process:

The receiving server reads the DKIM-Signature header, identifies the domain and selector, looks up the corresponding public key in DNS, and uses it to decrypt the signature. It then independently hashes the message and compares it to the decrypted hash. If they match, the message is authentic and unmodified.

DNS setup:

You publish your DKIM public key as a DNS TXT record at a subdomain defined by your selector. For example: selector._domainkey.yourdomain.com. Your email service provider generates the key pair and tells you what to publish. Most providers also sign on your behalf once the DNS record is in place.

Multiple providers:

If you send from multiple email platforms, each needs its own DKIM key pair, using a different selector. All can coexist in DNS simultaneously.

DKIM Example

A phishing attacker forges emails that appear to come from a bank’s domain, asking recipients to click a link and enter their login details. If the bank has DKIM configured and DMARC set to reject unauthenticated mail, the phishing email will not pass DKIM verification (the attacker does not have the private key) and will be rejected before it reaches inboxes. Without DKIM and DMARC, those emails may reach customers who trust the bank’s domain.

Why DKIM Matters for Marketers

Inbox providers treat authenticated mail more favourably than unauthenticated mail. DKIM, alongside SPF and DMARC, signals that your domain is managed responsibly and that your mail is what it claims to be. It also protects your domain reputation from spoofing attacks where criminals impersonate your brand, which can damage customer trust and your sending reputation at the same time.