What is a DKIM record?
A DKIM (Domain-based Message Authentication, Reporting, and Conformance) record is a type of DNS record that is used to help verify the authenticity of an email message. It works by cryptographically signing the email with the domain's private key, which the recipient can then use to verify that the message originated from the claimed domain.
How DKIM records work
When an email is sent, the sending mail server adds a DKIM signature to the message headers. This signature is generated using the domain's private key, which is stored in a DKIM record in the domain's DNS configuration. The recipient mail server can then retrieve the domain's public key from the DKIM record and use it to verify the signature, confirming that the message was indeed sent from the claimed domain.
The DKIM signing process works as follows:
- The sending mail server selects certain header fields and the body of the email to be signed.
- It then generates a cryptographic hash of the selected content.
- This hash is encrypted using the domain's private key and added to the email headers as the DKIM-Signature field.
When the recipient receives the email, they can retrieve the domain's public key from the DKIM record in the DNS. They can then use this public key to decrypt the DKIM-Signature field and verify that the hash matches the content of the email. If the verification is successful, the recipient can be confident that the email originated from the claimed domain and was not tampered with in transit.
Key DKIM record components
The DKIM record in the domain's DNS typically contains the following key information:
- v= The version of the DKIM specification being used.
- k= The type of cryptographic key, usually
rsa. - p= The public key used to verify the DKIM signature.
- t= A timestamp indicating when the record was last updated.
- s= The selector, which identifies the specific key being used.
Benefits and use cases of DKIM
DKIM provides several important benefits for email security and deliverability:
- Anti-spoofing: DKIM makes it much harder for attackers to spoof the sender domain of an email, reducing the risk of phishing and other email-based attacks.
- Improved deliverability: Email receivers that support DKIM are more likely to accept and deliver messages that pass DKIM verification, improving overall email deliverability.
- Reputation protection: DKIM helps protect the reputation of a domain by ensuring that only legitimate emails are sent on its behalf.
- Compliance: DKIM is a recommended or required email authentication mechanism for many email security regulations and standards.
Best practices for DKIM records
To ensure DKIM records are set up correctly and provide maximum security benefits, it's important to follow these best practices:
- Use a strong, unique private key for each domain.
- Rotate keys regularly (e.g. annually) to limit the exposure of any single key.
- Ensure the DKIM record is properly configured in the domain's DNS settings.
- Monitor DKIM verification reports to identify any potential issues or attacks.
- Keep the DKIM record up-to-date, especially when changing email service providers.
Real-world DKIM record example
Here is an example of a DKIM record for the domain example.com:
example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+STgHfRN6N1XQfMtH2bSPM4Vl3zyRJXQVEHcFa+lGRD3P6XIMpq6Zq6L3hc9VUq8BsZ2tAtdL38zg7V4lzGUzKjhfnRjQMUPAHNVCX+BxvXHi1TyWgALxYnq2FT0glzlp1MVRQNiMXeQ7B+qCrGEBtlzaFyEpYLVQLVcJ4wcfRQIDAQAB";
This record indicates that:
- The version of DKIM being used is 1 (
v=DKIM1). - The key type is RSA (
k=rsa). - The public key used for verification is the lengthy string of characters (
p=...).
With this information, a receiving mail server can retrieve the public key from the DKIM record and use it to verify the DKIM signature on emails from example.com.