What is a DKIM record?
DKIM stands for DomainKeys Identified Mail. It lets a domain sign its outgoing email so receiving servers can confirm two things: the message was sent with the domain's authorization, and the signed parts weren't changed in transit. The DKIM record is the DNS TXT record that publishes the domain's public key. The matching private key stays on the sending mail server.
How DKIM signing works
- The sending server hashes the message body and selected headers (such as From, Subject and Date), signs them with the private key, and adds a DKIM-Signature header to the message.
- That header names the signing domain (
d=example.com) and a selector (s=mail1). - The receiving server combines the two to look up the TXT record at
mail1._domainkey.example.com. - It uses the public key in that record to check the signature. If the message was altered after signing, or the signature doesn't match the key, DKIM fails.
What the record looks like
The record lives at selector._domainkey.domain and holds a short list of tags, for example v=DKIM1; k=rsa; p=MIIBIjANBgkqh...
v=DKIM1: the version.k=rsa: the key type.p=: the public key, Base64-encoded. An emptyp=means the key has been revoked.
Selectors let one domain publish several keys at once, for example one for its own mail server and one for a newsletter service, and make keys easy to rotate. Some hosted email services have you publish a CNAME at the selector name that points to a TXT record they manage. RSA keys must be at least 1024 bits, and 2048 bits is the usual recommendation.
DKIM vs. SPF vs. DMARC
| Record | Published at | What it does |
|---|---|---|
| SPF | The domain itself, such as example.com | Lists the servers allowed to send mail for the domain |
| DKIM | selector._domainkey.example.com | Publishes the public key that verifies message signatures |
| DMARC | _dmarc.example.com | Tells receivers what to do with mail that fails the checks (none, quarantine or reject) and where to send reports |
All three are TXT records. DKIM signs a message but doesn't encrypt it. DMARC builds on SPF and DKIM by requiring that a passing domain match the visible From address. Because the signature travels with the message, DKIM often still passes after a message is forwarded, where SPF tends to fail.
For the CompTIA A+ exam
Core 1 (220-1201) objective 2.4 lists the DNS TXT record and, under spam management, DKIM, SPF and DMARC; all three acronyms are on the Core 1 acronym list. Know which does what: SPF lists authorized sending servers, DKIM adds a signature checked against a public key in DNS, and DMARC sets the policy and reporting on top of both. Don't mix up the expansions: DKIM is DomainKeys Identified Mail, while Domain-based Message Authentication, Reporting, and Conformance is DMARC.