What Is DKIM? Signatures, Selectors and Public Keys
DKIM lets a sending mail system attach a cryptographic signature to selected message content so a receiver can verify it with a public key published for the signing domain in DNS.
How it works
The sender hashes selected headers and body content, signs that information with a private key, and adds a DKIM-Signature header containing a signing domain and selector. The receiver uses those values to find the corresponding public key and check the signature. A successful check is evidence about the signer and covered content; it is not proof that the message is safe or that its visible From address is genuine.
How DKIM signs a message
A sending system prepares the message and selects headers and body content to cover. It canonicalizes that content according to the signature settings, creates hashes, and signs the relevant data with a private key held by the sending service. The private key must remain secret and is not placed in the message or DNS.
The resulting DKIM-Signature header records information a receiver needs for verification, including the signing domain, selector, signed headers, body hash, signature value, and algorithms. DKIM does not necessarily cover every header or every byte in the same way; the signature identifies what was included and how it was canonicalized.
A receiver rebuilds the covered hashes, retrieves the public key, and checks the signature. A pass provides evidence that the covered content has not changed in a way that breaks the signature and that the signer had access to the private key corresponding to the DNS-published public key for that signing domain.
Signing domains, selectors, and DNS keys
Consider an illustrative DKIM-Signature containing d=example.com and s=mail2026. The d= value is the signing domain and s= is the selector. Together they produce the DNS name mail2026._domainkey.example.com, where the receiver looks for the public-key record.
A DKIM TXT record normally identifies its version and public-key material, conceptually including v=DKIM1 and p=.... The shortened p= value here is only a placeholder, not a production key. DNS publishes the public key; publishing the matching private key would defeat the design.
Selectors let one domain use different keys for separate services and rotate keys without relying on one permanent record. A domain can therefore have several valid selectors, and there is no universal selector a checker can reliably guess. The selector should come from the message signature, mail provider, or domain administrator.
What a DKIM result means
A DKIM pass means the receiver verified a particular signature using the public key for its signing domain and selector. It does not prove that the visible From domain is the same, that every part of the message was covered, or that the content and sender are trustworthy.
A failure is not one diagnosis. Signed content may have changed, the DNS key may be missing or incorrect, the selector or domain may be misconfigured, the signature may be malformed, or another verification problem may have occurred. The detailed result and the receiver's evidence are needed before changing DNS or mail configuration.
No DKIM signature is different from a signature that failed verification. A missing DNS record can also mean the wrong selector was checked or an old selector was retired. Conversely, finding a published key only confirms DNS configuration for that selector; it does not show that any received message was signed or that its signature passes.
DKIM, SPF, and DMARC are different
DKIM provides cryptographic signing evidence for selected message content and a signing domain. SPF evaluates whether sending infrastructure is authorized for a domain used in the SMTP envelope. They can produce different results because they examine different parts of mail authentication.
DMARC evaluates whether a passing SPF or DKIM domain aligns with the visible From domain, then applies the domain's published reporting and receiver-policy request. DKIM can contribute to DMARC when its verified signing domain aligns, but a DKIM pass alone does not guarantee DMARC pass.
Use the dedicated SPF and DMARC guides for their mechanisms, alignment, and policies. When investigating a received message, use the email-header workflow to interpret reported authentication results and routing evidence rather than treating one DKIM label as a complete verdict.
Practical guidance
- Obtain the exact signing domain and selector from the message, mail provider, or domain administrator before checking DNS.
- Distinguish a published DKIM key from successful verification of a particular message signature.
- Review DKIM with SPF and DMARC evidence without treating any single pass or failure as a safety verdict.
Common question
Does DKIM mean an email is safe? No. Valid DKIM provides signing evidence for the covered content and domain, but legitimate accounts can send harmful content and attackers can authenticate domains they control.