An All You Need to Know Guide to DomainKeys Identified Mail (DKIM)

An All You Need to Know Guide to DomainKeys Identified Mail (DKIM)

By: Karrie Westmoreland

DKIM (DomainKeys Identified Mail) helps protect your email domain from spoofing and tampering by adding a digital signature to outgoing emails. It’s like a ‘proof of authenticity’ stamp for your messages. DKIM relies on asymmetric cryptography to verify the integrity and authenticity of email messages. 

Here’s How DKIM Works: 

Asymmetric Encryption: DKIM uses a pair of keys: a public key and a private key.

The private key is used by the sending mail server to create a digital signature for certain parts of the email (e.g., headers and/or the body).

The public key is published in the DNS records of the sending domain, allowing receiving servers to verify the signature. 


Purpose
  • The primary goal of DKIM is to ensure the integrity and authenticity of the email. It helps verify that the email has not been tampered with during transit and that it was sent from an authorized source for the domain. 
  • It does not provide confidentiality. DKIM does not encrypt the email contents; the email remains readable to anyone who intercepts it during transit.  
  • If confidentiality is required, encryption protocols such as TLS (for securing email in transit) or PGP/SMIME (for end-to-end encryption) should be used alongside DKIM. 
 

Implementing DKIM involves several steps, typically completed by a domain administrator or email server manager. Here's a breakdown of the process: 

 

  1. Generate DKIM Keys
  • What: Create a pair of cryptographic keys (private and public). 
  • How: Most modern email systems provide tools to generate these keys. You can also use command-line tools like openssl to create them manually. 
  • Key Requirements: 
  • Key size: Typically 1024-bit or 2048-bit (2048 is preferred for better security). 
  • Save the private key securely; it will be used by your email server to sign outgoing emails. 
  • The public key will be published in your DNS record. 

 

  1. Create a DKIM DNS Record
  • What: Publish the public key in the DNS record of your domain. 
  • How: Add a new DNS TXT record for your domain. The record contains: 
  • A selector: A unique identifier that allows multiple keys to be used for different purposes or periods. (E.g., default, mail1, etc.) 
  • The public key: This will allow receiving servers to verify your email signatures. 

 

  1. Configure Your Email Server
  • What: Set up the server to use the private key for signing outgoing emails. 
  • How: The process depends on your email server: 
  • For Postfix: 

Install opendkim (a DKIM signing service). 

Configure opendkim with your private key and selector. 

Link opendkim with Postfix. 

 
  • For Microsoft Exchange: 

Use third-party DKIM tools like DKIM Exchange or native configurations (in newer versions). 

  • For Gmail/Google Workspace: 

Upload the private key in the admin console under the Authenticate Email section. 

The server will use the private key to generate a DKIM signature for specified email headers and attach it to each outgoing email. 

 

  1. Test Your DKIM Setup
  • What: Verify that DKIM is configured correctly. 

Authentication-Results: dkim=pass (signature verified) header.i=@example.com 

 

  1. Monitor and Maintain
  • What: Ensure your DKIM setup works consistently. 
  • How: Regularly monitor your DNS records and email logs.
  • Consider enabling DMARC to combine DKIM with SPF (Sender Policy Framework) for better email security. 
  • Rotate your DKIM keys periodically (e.g., every 6-12 months) to maintain security. 

 

Diagram of DKIM Workflow: 
  1. Outgoing Mail: 
  • The email server signs outgoing emails using the private key. 
  • Adds the DKIM signature in the email header. 
  1. Receiving Mail: 
  • The recipient server retrieves the public key from your domain's DNS. 
  • Verifies the signature against the received email.
     

By following these steps, your emails will be signed with DKIM, boosting trustworthiness and helping prevent spoofing. 

Below are some common mistakes people make when setting up DKIM: 
Mistake 
Description 
Solution 

Incorrect DKIM Record Placement 

Placing DKIM records under the wrong selector in the DNS. 

Ensure the DKIM TXT record is placed under the correct selector in your DNS settings. 

Not Signing All Outgoing Emails 

Only signing some emails instead of all outgoing emails. 

Configure your email server to sign all outgoing emails consistently. 

Using Deprecated Algorithms 

Using outdated algorithms like rsa-sha1, which are insecure. 

Use updated algorithms like rsa-sha256 for improved security. 

Failing to Update DNS Records 

Forgetting to update DNS records after rotating keys or making changes. 

Regularly update your DNS records when keys are rotated or settings are modified. 

Multiple DKIM TXT Records 

Adding multiple TXT records for the same selector, causing conflicts. 

Use only one TXT record per selector to avoid misconfigurations. 

RSA Keys Shorter Than 1,024 Bits 

Using RSA keys that are shorter than 1,024 bits, making them vulnerable. 

Use RSA keys of at least 1,024 bits, preferably 2,048 bits, for better security. 

Invalid Characters in Records 

Including invalid characters like line breaks or extra semicolons in DKIM records. 

Ensure your DKIM record is properly formatted without unnecessary characters. 

Truncated Keys 

Keys being truncated due to improper Base64 encoding or copying errors. 

Verify the full key is correctly encoded and included in the DNS record. 

Ignoring DKIM Validation Failures 

Failing to investigate and address DKIM validation errors. 

Regularly monitor email logs and validation tools to detect and fix DKIM issues. 

DNS Issues 

Propagation delays or misconfigurations causing DNS lookup failures. 

Confirm DNS settings are correct and allow time for propagation after changes. 

By avoiding these common mistakes, you can ensure your DKIM setup is robust and effective in verifying the integrity and authenticity of your emails.  

Footnotes: 
  1. Selector: 
    A unique identifier in the DKIM DNS record that helps differentiate multiple DKIM keys for the same domain. Example: A domain might have a selector called default for its primary key and backup for a secondary key. 
  1. Base64 Encoding: 
    A method for encoding binary data (such as cryptographic keys) into a readable string format that can be safely used in DNS records or email headers. 
  1. SPF (Sender Policy Framework): 
    An email authentication protocol that specifies which mail servers are authorized to send emails on behalf of a domain. SPF works in tandem with DKIM and DMARC to prevent email spoofing. 
  1. rsa-sha256: 
    A cryptographic algorithm used by DKIM to sign emails. It combines RSA encryption with the SHA-256 hashing function for secure and tamper-proof signatures. 
  1. DNS Propagation: 
    The time it takes for changes to DNS records (like adding a DKIM public key) to be updated across the internet. This delay can range from a few minutes to 48 hours. 
  1. DMARC (Domain-based Message Authentication, Reporting, and Conformance): 
    A protocol that builds on DKIM and SPF by providing a way for domain owners to instruct receiving servers on how to handle emails that fail authentication. 

Share This Post

Subscribe To Our Newsletter

Get updates and learn from the best

Previous SMTP Credential Hunt Attacks: The Hidden Threat to Email Security
Next SharePoint and Click-Fix Phishing: How to Detect and Defend Against It

More To Explore