How DKIM Cryptographic Signatures Protect Email Integrity
Standardized by RFC 6376, DomainKeys Identified Mail (DKIM) provides cryptographic proof that an email message was genuinely sent by the domain owner and has not been altered or tampered with in transit. Unlike SPF, which only verifies the IP address of the sending server, DKIM uses asymmetric public-key cryptographyto sign the message headers and body.
The sending server holds a secret private key and calculates a digital signature inserted into the email'sDKIM-Signature header. The recipient MTA extracts the public key from the sender's authoritative DNS records to mathematically verify the signature. Because the signature travels inside the message headers, DKIM remains fully valid even when emails are forwarded across intermediate mail relays.
What is a DKIM Selector and Why is It Required?
A single enterprise domain may utilize multiple independent email sending streams: corporate Google Workspace for employee emails, Amazon SES for transactional account receipts, and Mailchimp for marketing campaigns. If a domain could only publish a single public key, all vendors would have to share the same private key, posing a catastrophic security risk.
The selector parameter (indicated by the s= tag in the DKIM header) allows a domain to publish unlimited distinct key pairs. The recipient server queries the DNS TXT record at:
For example, Google Workspace often uses timestamp selectors such as 20230601._domainkey.google.com, allowing seamless key rotation without disrupting other mail streams.
The Security Mandate: Why 1024-Bit RSA Keys Must Be Retired
Historically, many DNS providers recommended 1024-bit RSA keys because older DNS implementations struggled with UDP packet fragmentation caused by TXT records exceeding 255 characters. However, modern cloud computing has made 1024-bit RSA keys vulnerable to practical cryptanalytic factoring attacks.
Base64 key length is approximately 172 characters. Major providers (Gmail, Microsoft) have deprecated 1024-bit keys and may treat them with lower deliverability scores. Senders should rotate to 2048-bit keys immediately.
Base64 key length is approximately 392 characters. Provides robust long-term security. Modern DNS servers support split 255-character string chunks enclosed in parentheses to handle the larger key size seamlessly.
Frequently Asked Questions (FAQ)
Open the email in your client (e.g. Gmail), select "Show original" or "View raw headers", and search for theDKIM-Signature: header. Locate the s= tag (e.g. s=20230601; d=example.com). In this example, the selector is 20230601.
An empty public key tag (p=;) formally indicates that the key has been revoked. Receiving servers will treat any signature created with this key as invalid, allowing administrators to instantly decommission compromised keys.
Yes! RFC 8463 standardized Ed25519 (Edwards-curve Digital Signature Algorithm) for DKIM. Ed25519 produces much shorter signatures and smaller public keys with superior cryptographic security compared to RSA, though some legacy enterprise mail systems still require RSA fallback.