# What is DomainKeys Identified Mail (DKIM)?

> DomainKeys Identified Mail (DKIM) is an email-authentication protocol that allows a domain to attach a cryptographic signature to a message.

- Canonical URL: https://yellowcube.eu/glossary/domainkeys-identified-mail/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The sending system signs a hash covering specified header fields and body content with a private key. A receiving system retrieves the corresponding public key from DNS, using the signing domain and selector in the `DKIM-Signature` header, and verifies whether the covered content still matches.

A valid DKIM signature shows that the signing domain took responsibility for the message and that the signed content was not altered after signing in any way the signature detects. Because verification is tied to message content rather than the last sending IP address, a signature can survive forwarding when the message remains unchanged.

### Key points

- **Signing identity:** The `d=` tag identifies the signing domain; the `s=` selector identifies the DNS key record and supports separate senders and key rotation.
- **DMARC contribution:** DKIM can satisfy DMARC when the signature passes and its signing domain aligns with the domain visible in the From field.
- **Operational discipline:** Protect private keys, use current algorithms and suitable key sizes, rotate keys, retire old selectors, and monitor authentication results.
- **Important limitation:** Mailing-list footers, subject changes, gateway transformations, or other modifications can invalidate a signature. A signature also protects only the content selected by the signer.

### Related terms

[Sender Policy Framework (SPF)](<https://yellowcube.eu/glossary/sender-policy-framework/>) · [Domain-based Message Authentication, Reporting, and Conformance (DMARC)](<https://yellowcube.eu/glossary/domain-based-message-authentication-reporting-and-conformance/>) · [Email security](<https://yellowcube.eu/glossary/email-security/>) · [Email spoofing](<https://yellowcube.eu/glossary/email-spoofing/>) · [Digital signature](<https://yellowcube.eu/glossary/digital-signature/>)

### Sources

[RFC 6376: DKIM Signatures](https://www.rfc-editor.org/info/rfc6376/) · [RFC 8301: DKIM Cryptographic Algorithm and Key Usage Update](https://www.rfc-editor.org/info/rfc8301/) · [NIST SP 800-177r1: Trustworthy Email](https://csrc.nist.gov/pubs/sp/800/177/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.