Email has always had its fair share of security issues, and simply encrypting messages between servers isn’t enough to keep spammers and scammers at bay. Phishing, spamming, and spoofing rely on deceptive tactics to send emails that look like they’re from trusted senders. This not only damages trust but also puts people and businesses at risk.
One way to tackle these problems is to validate that an email is from an authorised sender and hasn’t been tampered with. That’s where DKIM (DomainKeys Identified Mail) comes in—a powerful tool to help secure email communications.
What Is DomainKeys Identified Mail DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication protocol that helps organisations sign messages so mailbox providers can confirm they’re genuine.
Using cryptographic authentication, DKIM ensures that emails stay intact during transit. It’s an effective way to guard against email attacks, keeping employees and customers safe. While SPF (Sender Policy Framework) checks the sender’s IP address, DKIM adds an extra layer of security by focusing on message integrity and trust.
How DKIM Works?
The sender starts by choosing the fields to include in the DKIM signature, like the “from” address, subject, and body. These fields need to stay the same during transmission—any changes will break the DKIM authentication.
For example, fields like `From: John Smith <john.smith@example.com>` and `Subject: Meeting Reminder` are hashed into a string like `d2c7e3fbc1298476a8def4569012ab34`. This hash is then encrypted with the sender’s private key to keep it secure.
When the email arrives on the recipient’s side, their email provider or gateway uses the sender’s public key to decrypt the DKIM signature and compare it to a fresh hash of the email fields. If the two hashes match, it confirms the fields weren’t tampered with during delivery and proves the email is genuine.
What Is a DKIM Signature?
The DKIM signature is key to checking an email’s authenticity and ensuring it hasn’t been tampered with. It’s a hash created from parts of the email, like the domain and message body, which decide when the email is sent and locked in place. The sender encrypts this hash using the domain’s private key to form the signature.
When the email arrives, the recipient’s server uses the sender’s public key to create a new hash from the same parts and compares it with the decrypted signature. If they match, the email passes the check, showing it’s unchanged. If they don’t, it signals possible tampering, helping keep phishing and malware at bay.
Why Is the DKIM Record Essential?
The DKIM record is stored in the domain’s Domain Name System (DNS) records. It plays an important role in email delivery and helps protect trusted domains from being impersonate by cybercriminals. As a result, phishing and spam attacks become harder to carry out. DKIM works together with Domain-based Message Authentication, Reporting and Conformance (DMARC) and SPF to create strong email security.
While it’s not a required standard, setting up a DKIM record to your DNS is highly recommended. Major email providers like Gmail, Yahoo, AOL, and Hotmail use it to check message authenticity and assess domain reputation.
Setting up DKIM improves email deliverability by building trust in your domain. However, remember that DKIM doesn’t encrypt outgoing emails, so sensitive data could still be at risk.
Role of DKIM Record in Email Security
DKIM helps organisations control emails sent from their domains and lets recipients check if they’re genuine. Using public key cryptography, DKIM adds a digital signature to outgoing emails, making it easier to spot forgeries and stop email spoofing.
Keeping your DKIM record up-to-date is key to protecting your domain’s reputation and ensuring your emails land where they should.
5 Best Practices When Setting Up a DKIM Record
1. Deploy Long Keys
Keep your DKIM records safe with strong keys. Use at least 1024-bit keys; if you can, go for 2048-bit. Steer clear of shorter keys like 512-bit—they’re easier to crack.
2. Regularly Rotate Keys
To keep your email secure, rotate your DKIM keys at least twice a year. This helps reduce the chance of them being misused by hackers.
3. Monitor Recipient Activity
Keep an eye on how and when receiving email servers accept DKIM-signed emails. It’s a smart way to understand recipient behaviour and keep your emails landing where they should.
4. Track Third-party Activity
Ensure third-party vendors sending you emails follow your organisation’s email security rules and best practices.
5. DKIM Signage Checks
Make sure outgoing emails are DKIM-signed and sent from approved domains. Check that all public keys have a matching private key to keep email signing working properly.
What is the Difference Between SPF and DKIM?
Email fraud is a massive problem for businesses. Attackers can spoof your company’s email address to impersonate you, trick customers, or deliver phishing attacks. To combat this, email security relies on two key protections:
✅ SPF (Sender Policy Framework)
✅ DKIM (DomainKeys Identified Mail)
Both help verify legitimate emails, but they work in different ways.
What is SPF? – “Checking the Sender’s ID”
SPF (Sender Policy Framework) is like checking the ID badge of someone entering your office.
- It tells email servers which mail servers are allowed to send emails on behalf of your domain.
- When an email arrives, the receiving server checks if it was sent from an approved mail server.
✅ If it matches your SPF record, the email is allowed through.
❌ If it doesn’t match, it may be rejected or marked as spam.
What is DKIM? – “Sealing the Letter with a Digital Signature”
DKIM (DomainKeys Identified Mail) is like sealing a letter with a unique stamp that proves it hasn’t been tampered with.
- DKIM adds a digital signature to every outgoing email.
- The receiving server checks this signature against the company’s public records to verify authenticity.
✅ If the signature is valid, the email is trusted.
❌ If the signature is missing or altered, the email may be fake.
SPF vs DKIM
| Feature | SPF (Checking the Sender’s ID) | DKIM (Sealing the Letter) |
| What it does | Confirms if the email came from an approved mail server | Confirms if the email was altered after being sent |
| How it works | Checks if the sender’s IP is authorized | Uses a cryptographic signature to verify authenticity |
| Prevents | Attackers from using your domain to send fake emails | Emails being altered in transit |
| Used by | The domain owner to define approved mail servers | The email provider to sign outgoing messages |
Why You Need Both SPF and DKIM?
Many businesses make the mistake of only setting up SPF, but SPF alone is not enough.
SPF protects against unauthorized senders but doesn’t prevent email tampering.
DKIM prevents email tampering but doesn’t verify the sender’s mail server.
To fully protect your domain, you should also use DMARC (Domain-based Message Authentication, Reporting & Conformance). DMARC enforces DKIM and SPF, ensuring that emails failing these checks are rejected or quarantined.
FAQs
What is the difference between DKIM and DomainKeys?
DomainKeys Identified Mail (DKIM) builds on Yahoo’s DomainKeys and takes ideas from Cisco’s Identified Internet Mail standard (IIM) to offer better security and flexibility. Unlike DomainKeys, DKIM supports multiple signature algorithms, checks the header and body, allows third-party signing, self-signs the DKIM-Signature header, uses wildcard parameters, and includes signature timeouts in DNS. These updates make DKIM a smarter and more reliable choice than DomainKeys alone.
How do I add a DKIM record in DNS?
You can add DKIM records to the DNS as TXT records. Save the private key to the Simple Mail Transfer Protocol (SMTP) or Mail Transfer Agent (MTA). This helps outgoing emails get signed properly so receiving servers can check them using the public key in the DNS record.
How do I know if my DKIM is correct?
To check if your DKIM is set up correctly, use online DKIM lookup tools or email testing services. These tools review your DNS records and authenticate that the DKIM signature matches properly. You can also send a test email to a platform that shows authentication details to ensure everything works as it should. If the message passes DKIM checks, it means it’s all set up correctly.
Can I have multiple DKIM records?
Yes, a domain can have multiple DKIM records in its DNS. Each key is paired with a unique DKIM selector, which is included in the DKIM signature of outgoing emails.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
