DKIM signing

DKIM, short for DomainKeys Identified Mail, is an authentication method that helps validate mail from a domain.¹ The sender hashes selected headers and the body, signs the hash with a private key, and adds a DKIM-Signature header. The receiver retrieves the public key from DNS and checks the signature.² DKIM checks whether the message was altered in transit.³ The signature stays valid while intermediate systems leave the signed parts alone.⁴ An outbound gateway can change those parts by adding a footer.⁵ Set up DKIM in this order: identify the sending service, create the key pair, publish the public key, enable signing, then test the message after its full route.

Before you configure

Find every service that sends mail for the domain and check whether DKIM already exists. The setup path varies by email service.⁶ Cloud-based services automate some of the configuration, so look for a DKIM control in the administration panel or contact the service provider.^{7, 8}

A domain may already have DKIM configured by default, so check before creating a new record.⁹ A free DKIM checking tool can show whether the domain already has a working setup.¹⁰

Check which service signs each type of outbound mail, whether the domain already has a public key in DNS, and whether an outbound gateway sits between the sending service and the recipient. Continue once you know which system will sign the message and which system controls the DNS record.

Generate the key pair

Choose the route that matches your sending architecture. The source system needs the private key, and the public key must reach DNS.

If you configure DKIM directly on email servers, generate an RSA public and private key pair.¹¹ Use the recommended 2048-bit size.¹² The source email system uses the private key to digitally sign important parts of outbound messages.¹³

Review what the service signs before enabling it. Depending on the source email system, signed headers can include From, To, Subject, MIME-Version, Content-Type, Date, and other message-header fields.¹⁴ Identify the private key used for signing and the public key that belongs in DNS.

Publish the public key in DNS

Publish the public half of the pair for the signing domain so receiving systems can retrieve the material they need to read the signature.

The DNS record type depends on the email system. Microsoft 365 uses CNAME records, while other email systems might use TXT records.¹⁵ Receiving servers use the domain's public DKIM key to read the signature and authenticate messages from that domain.¹⁶

Use the record values supplied by the service that generated the key. Keep the signing domain visible in your checks because the d= value in the DKIM-Signature header identifies it.¹⁷

Enable signing and test the full route

Publishing the DNS record prepares verification. The sending system must still add a signature to the message that leaves it.

Make sure the email is DKIM signed before you treat the setup as complete.¹⁸ Send a controlled message through each real sending path, including any gateway. Inspect the raw message and confirm the signing domain in the DKIM-Signature header. Then check whether the receiver can retrieve the public key and verify that the signature matches the message content.¹⁹

If the check fails, work backward through the route. Compare the signing domain with the DNS record, then inspect anything that changes the message after signing. A failed DKIM validation can lead to quarantine or rejection according to the configured conditions.²⁰

Rotate and maintain the keys

Treat rotation as a planned configuration change. Keep the signing service, DNS record, and selector in the same change record so a future failure can be traced quickly.

DKIM keys do not expire, though periodic rotation is recommended every 12 months.²¹ When rotating, create a new key with a new selector and follow the same setup steps.²² Test the new route before treating the rotation as finished.

What not to do

Use these checks to catch failures that a basic DNS lookup can miss.

• Do not leave outbound gateway settings unverified. Those settings can interfere with DKIM.²³
• Do not treat DKIM as a spam filter. It does not filter or identify spam on its own.²⁴
• Do not make a configuration change without a recovery plan, because DKIM misconfiguration can have serious consequences.²⁵