DKIM is an email authentication method based on a digital signature. The acronym stands for DomainKeys Identified Mail, and it helps prevent email fraud and phishing. In practice, it is an implicit exchange between mail servers (the sender’s and the recipient’s) that verifies the message is authentic.
What DKIM is and where the name comes from
This authentication system was born in 2004 from the merger of two methods: Yahoo’s DomainKeys and Cisco’s Identified Internet Mail. Combining the two gave us the current acronym.
Here’s how it works: the sender’s mail server adds a digital signature to the outgoing message. Whether it’s a newsletter, a private message or any other kind of email, the receiving server checks that the signature is valid.
Above all, DKIM verifies that the message has not been altered since it left the sender, that is, since the signature was applied. This thwarts scammers who exploit well-known domain names and addresses to “hook” their victims.
How it works under the hood
DomainKeys Identified Mail relies on a few core components.
- Hashing: an algorithm that ties a string of characters (called a hash) to the message. To spoof it, a scammer would need the exact same string.
- Asymmetric cryptography: a method that uses a pair of keys. Whatever is encrypted with key A is decrypted with key B, and vice versa.
How to set up DKIM on your domain
Want to set up this kind of protection on your domain? You can use a free tool such as the one from easydmarc.com.
Or you can do it manually by creating a TXT record in your DNS. It must contain:
- The version, usually written as v=DKIM1.
- The encryption algorithm, which is typically RSA (k=rsa).
- The public key (p=), a long string of characters.
- The selector, which varies from provider to provider. Example: default._domainkey or k1._domainkey
That said, many email providers generate one for you automatically.
Checking your DKIM
Many online checker tools, including free ones, let you verify that your mail domain has a correctly configured DomainKeys Identified Mail record, and help you fix it by pinpointing any errors. This helps your messages reach the recipient.
If you skip this step, your emails could end up in spam or be rejected by the recipient’s mail server. That would be a serious problem for your email marketing plan and for your online presence in general.
Is DKIM enough to stop spam?
Unfortunately, no. But don’t worry: several other systems work together to keep your inbox, and your users’ inboxes, safe and secure. One of the most important is the SPF record. While SPF checks the authenticity of the “envelope”, DKIM verifies the content through its cryptographic signature.
On top of these you can add other systems such as DMARC, which provides further protection against spoofing and against scammers who impersonate others by abusing email domains.