DKIM explained
What exactly is DKIM?
DKIM is one of the three pillars of email authentication, alongside SPF and DMARC. The name stands for DomainKeys Identified Mail. Where SPF checks which server may send, DKIM goes a step further: it proves that the content of your message wasn't altered in transit.
That works with a key pair. There's a secret (private) key that only your sending server knows, and a public key that you publish in your DNS. When sending, the server places a signature over the message with the secret key. The recipient retrieves your public key and uses it to check whether that signature is correct.
Think of it as a wax seal on a letter. Only you have the stamp (the secret key), and anyone can tell from the seal whether the letter has been broken open in transit. If the signature is valid, the recipient knows two things: the message really comes from your domain, and the content hasn't been tampered with.
What does DKIM do for you?
DKIM delivers three concrete benefits.
- Proof of authenticity. The signature confirms that the message comes from your domain.
- Protection against tampering. If the content is changed in transit, the signature no longer matches and that stands out.
- Better deliverability. Major mail providers see valid DKIM signatures as a sign of a serious sender, which increases the chance of the inbox.
Since 2024 this matters extra: major mail providers require bulk senders to have their email correctly authenticated, and DKIM is a fixed part of that. If you notice your messages ending up in spam anyway, read why your mail ends up in spam.
How do you set up DKIM properly?
Setting up DKIM comes down to two things: the sending server has messages signed, and you publish the corresponding public key in your DNS.
The steps in broad terms:
- Generate a key pair (your email provider usually does this). The secret key stays on the server; you get the public key.
- Publish the public key as a DNS record of type TXT, at an address with a so-called selector, for example
selector1._domainkey.yourdomain.eu. - Turn on signing on the sending server, so that every outgoing message gets a signature.
- Test a message and check whether the signature is valid at the recipient.
What to watch out for:
- The selector must match. The name in your signature must exactly match the DNS record you publish.
- Keep the secret key safe. If it leaks, someone else can create valid signatures on your behalf. In that case, rotate the key.
- Copy the public key in full. A missing character makes the check invalid.
- Choose a sufficiently strong key (2048 bits is the recommendation today over 1024 bits).
If you want to do it yourself, follow the separate guide on setting up DKIM. You'll find a concise definition in the glossary entry on DKIM.
DKIM works best together with SPF and DMARC
DKIM proves that your message is genuine and unchanged, but on its own it doesn't say which servers may send (SPF does that) and it doesn't determine what should happen if a check fails (DMARC does that). Only when the three are set up together do you really close the door. How to align them, you'll read in the guide on setting up SPF, DKIM and DMARC together.
How Mailflux arranges this for you
With Mailflux you don't have to generate keys or paste DNS records yourself. We manage SPF, DKIM and DMARC for your domain and monitor the IP reputation of our sending servers, so your outgoing mail is neatly signed and sends the right signals. Every plan also filters with machine learning against spam, phishing and malware, with standard antivirus, antispam, antimalware and automatic backups.
You get professional email on your own domain, hosted in Europe and GDPR-compliant, with optional two-factor authentication. We take care of the signatures behind the scenes.
FAQ
Frequently asked questions
What's the difference between SPF and DKIM?
SPF checks which servers may send on behalf of your domain; DKIM proves with a digital signature that a message really comes from you and wasn't changed in transit. They complement each other: SPF looks at the sender, DKIM at the content. For full protection you use both, together with DMARC.
What is a DKIM selector?
A selector is a label that indicates which public key belongs to a signature, for example selector1. That way you can use several keys side by side and rotate them safely. The selector in your outgoing signature must exactly match the corresponding DNS record, otherwise the check fails.
Do I have to replace my DKIM key?
It's wise to rotate your key now and then, and certainly if you suspect the secret key has leaked. A strong key (2048 bits) is the recommendation today. With a managed email service, that rotation usually happens automatically, without you having to do anything for it.