How DKIM works
When a message is sent, the mail server hashes the headers and body and encrypts the hash with a private key, producing a DKIM-Signature header. The receiving server reads the selector name, fetches the public key from a TXT record in the domain's DNS and checks the signature. A match proves the message was not altered in transit and really came from that domain.
Why DKIM matters
DKIM solves several problems at once:
- Authenticity — confirms the message was sent on behalf of the domain rather than forged.
- Integrity — any change to the text or headers breaks the signature and the check fails.
- Reputation — signed mail is less likely to be marked as spam and raises trust in the sending domain.
DKIM works together with SPF, which validates the sending server, and a DMARC policy; together they protect mail arriving through the domain's MX servers.
