DKIM Explained: How DKIM Protects Your Emails

Email authentication has become essential for businesses that rely on email communication. Whether you are sending cold emails, newsletters, SaaS notifications, or transactional messages,

mailbox providers now expect domains to be properly authenticated.

One of the most important authentication methods is DKIM.

DKIM helps receiving mail servers verify that your emails are legitimate and have not been altered during delivery. It improves email trust, protects your domain reputation, and plays a major role in modern email deliverability.

In this guide, you’ll learn:

• What DKIM is
• How DKIM works
• What DKIM selectors are
• How DKIM protects email integrity
• How to configure DKIM
• Common DKIM problems
• DKIM vs SPF differences

You can also verify your setup using the free tools from LeadCanal:

• DKIM Checker
• DKIM Generator
• SPF Checker
• DMARC Checker

Introduction

Why Email Signatures Matter

Email spoofing and phishing attacks have become major threats for businesses worldwide. Attackers often impersonate trusted brands to trick users into:

• Sharing passwords
• Downloading malware
• Sending payments
• Revealing sensitive information

Without authentication, receiving mail servers cannot easily verify whether a message truly came from your domain.

DKIM helps solve this problem by digitally signing your emails.

This allows mailbox providers like Google Workspace, Microsoft 365, and Yahoo Mail to verify:

• The sender is legitimate
• The message was not modified
• The domain is trusted

This improves both email security and deliverability.

What is DKIM?

DKIM stands for DomainKeys Identified Mail. It is an email authentication protocol that uses cryptographic signatures to verify outbound messages.

Instead of simply checking which server sent the email, DKIM verifies the integrity of the message itself.

When DKIM is enabled:

• Outgoing emails are signed using a private key
• A public key is published in DNS
• Receiving servers validate the signature

If the signature matches correctly, the email passes DKIM authentication.

How DKIM Works

DKIM uses public-key cryptography to authenticate emails.

This process happens automatically in the background whenever emails are sent and received.

Step 1: Generate DKIM Keys

A DKIM setup starts with generating:

• A private key
• A public key

The private key stays securely on your mail server.

The public key is published in DNS.

Step 2: Sign Outbound Emails

When your server sends an email:

• It creates a digital signature
• The signature is added to the email header

The signature contains encrypted information based on:

• Message content
• Sender information
• DKIM configuration

Step 3: Receiving Server Verification

When the email reaches the recipient:

1. The receiving server retrieves the public key from DNS
2. It checks the signature
3. It verifies the email integrity

If everything matches:

• DKIM passes

If the message was altered:

• DKIM fails

Digital Signatures Explained

A digital signature works similarly to a security seal.

If the message changes after signing:

• The signature becomes invalid
• Authentication fails

This helps prevent:

• Email tampering
• Content modification
• Message forgery

For example, if attackers intercept an email and modify:

• Links
• Attachments
• Content

the DKIM signature will no longer match.

This makes DKIM extremely valuable for protecting email integrity.

DKIM Selectors Explained

DKIM uses something called selectors to organize and identify keys.

A selector acts like a label that tells receiving servers which public key should be used for verification.

Why Selectors Exist

Selectors allow organizations to:

• Rotate keys safely
• Use multiple email systems
• Separate authentication configurations

For example:

• Marketing emails may use one selector
• Transactional emails may use another

This improves flexibility and security management.

Example DKIM Selector

Example hostname:

selector1._domainkey.example.com

In this example:

• selector1 is the selector
• _domainkey identifies DKIM
• example.com is the domain

The receiving server uses this hostname to retrieve the public key.

DKIM DNS Record Example

DKIM records are published as TXT records in DNS.

Example DKIM record:

v=DKIM1; k=rsa; p=MIGfMA0GCSq...

Each tag has a specific meaning.

v=DKIM1

Defines the DKIM version.

Example:

v=DKIM1

p=MIGfMA0GCSq...