Email Authentication: DKIM Explained

DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was not altered in transit and that it was sent by an authorized server.

What DKIM does

DKIM allows a domain owner to digitally sign outgoing emails. The signature is verified by the receiving server using a public key published in DNS. If the signature verification fails, the email may have been tampered with in transit.

How DKIM works

Domain owner generates key pair. A private key is used for signing, and a public key is published in DNS.
Outgoing email is signed. The sending server adds a DKIM-Signature header to the email, containing a cryptographic signature of selected header fields and the body.
Email is sent. The signed email travels through the internet to the recipient.
Receiving server retrieves public key. The receiving server looks up the public key from the sender's DNS.
Signature is verified. The receiving server uses the public key to verify the signature. If verification succeeds, the email has not been altered.

DKIM signature structure

A DKIM-Signature header contains several fields:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=example.com; s=selector;
 h=from:to:subject:date;
 bh=hash_of_body;
 b=signature

Key fields:

v= — DKIM version
a= — Algorithm used (rsa-sha256 is common)
d= — Signing domain
s= — Selector (used to find the public key in DNS)
h= — Headers that were signed
bh= — Hash of the body
b= — The actual signature

DKIM verification results

Pass: The signature verified successfully. The email has not been altered.

Fail: The signature verification failed. The email may have been tampered with or the signature is invalid.

Neutral: The signature could not be verified (e.g., public key not found).

TempError: A temporary error occurred during verification (e.g., DNS lookup failure).

What DKIM prevents

Message tampering: If someone intercepts and modifies an email in transit, the DKIM signature will no longer verify.

Forged sender addresses: While DKIM does not directly prevent From address forgery, it does prove that the email was sent by an authorized server for the domain in the d= field.

DKIM limitations

Signing can be stripped: Malicious intermediaries can remove DKIM signatures, though this is detectable.

Key management: If the private key is compromised, an attacker can sign fraudulent emails. Keys must be rotated periodically.

Does not prevent spam: DKIM only proves authenticity, not that the email is wanted. Spammers can use DKIM for their legitimate domains.

Temporary email and DKIM

Temporary email services typically do not send email, so they do not need DKIM signing for outbound mail. When you receive email in a temporary inbox, the DKIM verification happens on the incoming message — the sender's DKIM signature is verified, not the temporary email service's.

Questions

Does DKIM encrypt email content?

No. DKIM provides authentication and integrity verification, not encryption. The email content remains visible in transit. For encryption, you need end-to-end encryption like PGP or S/MIME.

What happens if DKIM verification fails?

The email may be rejected, marked as spam, or delivered with a warning depending on the receiving server's policy. Many systems treat DKIM failure as a strong negative signal.