The sending system signs a hash covering specified header fields and body content with a private key. A receiving system retrieves the corresponding public key from DNS, using the signing domain and selector in the DKIM-Signature header, and verifies whether the covered content still matches.
A valid DKIM signature shows that the signing domain took responsibility for the message and that the signed content was not altered after signing in any way the signature detects. Because verification is tied to message content rather than the last sending IP address, a signature can survive forwarding when the message remains unchanged.
Key points
Signing identityThe d= tag identifies the signing domain; the s= selector identifies the DNS key record and supports separate senders and key rotation.
DMARC contributionDKIM can satisfy DMARC when the signature passes and its signing domain aligns with the domain visible in the From field.
Operational disciplineProtect private keys, use current algorithms and suitable key sizes, rotate keys, retire old selectors, and monitor authentication results.
Important limitationMailing-list footers, subject changes, gateway transformations, or other modifications can invalidate a signature. A signature also protects only the content selected by the signer.