DKIM — DomainKeys Identified Mail

What DKIM means

DKIM — DomainKeys Identified Mail — is defined in RFC 6376. The signing server adds a DKIM-Signature header field reading v=1; a=rsa-sha256; d=example.com; s=mail; h=from:to:subject:date; bh=...; b=..., in which d= is the signing domain, s= names the selector, h= lists the header fields covered, bh= is a hash of the body and b= is the signature itself.

The public key record is a TXT record at mail._domainkey.example.com holding v=DKIM1; k=rsa; p= followed by the base64 key. A verifier reads d= and s= from the message, fetches that record and recomputes both hashes. RFC 8301 requires signing keys of at least 1024 bits and recommends 2048; RFC 8463 adds Ed25519, whose keys are short enough to avoid the record splitting that long RSA keys force on a zone file.

A signature survives exactly what it covers and no more. A mailing list that rewrites the subject, or a gateway that reflows the body, invalidates it — the l= tag can limit the body hash to a prefix, but that leaves the message open to appended content and is best omitted. What DKIM does not do is tie the signing domain to the address a reader sees; that is DMARC's alignment check, and it is why a valid signature from an unrelated domain proves nothing about who the mail claims to be from.