How to Set Up DKIM: Best Practices & Technical Guide

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. “However, its setup and maintenance are more complex compared to SPF and DMARC, which can result in serious consequences if misconfigured.” Security considerations to remember DKIM relies on cryptography to ensure email authenticity. However, key size and rotation, or algorithm weaknesses, need to be taken into consideration as well. Protecting DKIM from attacks DKIM is not bulletproof to cyberattacks and misconfigurations. By following security best practices, performing regular security awareness training, and regularly reviewing your DKIM implementation, the damage from attacks or misconfigurations can be minimized. Why DKIM? SPF vs. DKIM While SPF is known to have a wider adoption than DKIM, it does not provide the same level of security. SPF allows a domain owner to publish a list of authorized servers in DNS, so that receiving mail servers can check whether the sending server is permitted to send emails for that domain. However, it doesn’t guarantee the integrity of the email body or any email header. Furthermore, if emails are forwarded between mail servers, e.g., if you are using Salesforce, the SPF verification fails.  On the other hand, DKIM relies on cryptographic algorithms to “sign” email headers and the body to guarantee email authenticity and integrity. Even if your email infrastructure changes or emails are legitimately forwarded, the email signature will still be valid, and the recipient can always verify its validity, regardless of the IP that sent the email. That is why, while we recommend implementing both protocols for a defense-in-depth approach, you should consider these key differences before choosing one. How to set up DKIM Here is a technical step-by-step guide on how to set up DKIM from scratch: 1. Generate a cryptographic key pair DKIM relies on public-key cryptography to work. All algorithms in this field of cryptography require a public and a private key pair for different cryptographic operations. There are several packages or software in Linux and Windows that can help generate such keys for you.

   In DKIM signing

2. The introduction of the Simple Mail Transfer Protocol (SMTP) in 1982 marked a major advancement in global electronic communication. Designed to simplify message delivery, SMTP quickly became the backbone of email systems. However, it was not built with strong security in mind. Over time, threat actors have taken advantage of its weaknesses, particularly its inability to verify the sender’s identity from the recipient’s mail server—leaving it vulnerable to domain impersonation attacks.  To close this security gap, the Internet Engineering Task Force (IETF) introduced three key email authentication protocols: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Each protocol addresses different aspects of email authentication and has its own strengths and limitations. Among them, DKIM plays a vital role in ensuring the authenticity and integrity of messages. However, its setup and maintenance are more complex compared to SPF and DMARC, which can result in serious consequences if misconfigured. For example, in 2023, Twitter (now X) failed to rotate DKIM keys, causing their emails to be rejected by receiving mail servers. To help prevent such issues, this article offers a step-by-step technical guide to securely setting up DKIM. It also highlights important security and cryptographic considerations for maintaining a reliable and secure DKIM configuration over time. Summary of key email security protocols and their importance Concept Description  Why DKIM? DKIM provides specific security attributes, such as email integrity, that SPF does not offer. Furthermore, it uses Cryptography instead of IP whitelisting to verify the email authenticity.  How to properly set up DKIM DKIM requires the creation of a cryptographic key pair, DNS record configuration, and email server configuration to digitally sign outbound emails. “Furthermore, if emails are forwarded between mail servers, e.g., if you are using Salesforce, the SPF verification fails.” For our example, below, we use OpenSSL to create a 2048-bit (key length) RSA public and private key.  # Generate a 2048-bit private keyopenssl genpkey -algorithm RSA -out dkim_private.key -pkeyopt rsa_keygen_bits:2048# Extract the public key from the private keyopenssl rsa -pubout -in dkim_private.key -out dkim_public.key These OpenSSL commands will store the 2048-bit private key in the dkim_private.key file and the 2048-bit public key in the dkim_public.key. 2. Extract the public key Since the public key in dkim_public.key file is surrounded by a header and a footer, e.g., -----BEGIN PUBLIC KEY-----, you will have to extract the public key part either manually or using this Linux command: awk 'NR>1 && NR<NF {printf "%s", $0} END {print ""}' dkim_public.key | sed 's/-----BEGIN PUBLIC KEY-----//; s/-----END PUBLIC KEY-----//' | tr -d '\n' 3. Encode the key You need to base64-encode the public key first to avoid any misinterpretation of the special characters the public key might contain. There are several ways to base64-encode a string, e.g., on Linux: echo "<public_key_from_step_2>" | base64 4. Create a DNS TXT record Create a DNS TXT record for your domain following the following syntax: <selector>._domainkey.<your_domain>. For example, if your test domain is “example.com” and we name the selector dkimTest, your DNS TXT record should look like this:       dkimTest._domainkey.example.com Set the value/content of the DNX TXT record to the following: Name Type Content TTL dkimTest._domainkey.example.com TXT v=DKIM1; k=rsa; p= <base64_encoded_public_key> 6000 Note that you can alternatively use a DNS CNAME record as well. However, RFC 6376, the core standard for DKIM, specifies the use of TXT records for this purpose. 5. Configure your mail server Configure your mail server to send signed emails for your domain. For this, several things need to be configured, e.g., the secure storage of the private key.

   In SPF records