DKIM Signature Mechanics

Why this matters

DKIM cryptographically signs each outgoing email so receivers can verify the message wasn't tampered with in transit. It ties your domain's reputation to individual messages and is required by major inbox providers for high-volume senders.

Try it yourself

1. Send a test email to Gmail and open 'Show original' — find the DKIM-Signature: header and confirm the d= tag matches your sending domain.
2. Look up your DKIM public key with dig TXT selector._domainkey.yourdomain.com and verify it returns a p= value (the public key).
3. Check what happens to the DKIM result if you forward a signed email — open headers on the forwarded copy and note whether the signature still passes or breaks.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain what DKIM is and why it's different from SPF in protecting email integrity.

2. Why it works (the mechanism)

Walk me through how DKIM signs an outgoing message and how the receiving server uses the public DNS key to verify it.

3. Advanced — application & what's next

If DKIM signing is handled by your ESP but you also self-host a transactional server, how do you configure dual DKIM selectors without conflicts?

References

• RFC 6376 — DomainKeys Identified Mail