An All You Need to Know Guide to DomainKeys Identified Mail (DKIM)

By: Karrie Westmoreland

DKIM (DomainKeys Identified Mail) helps protect your email domain from spoofing and tampering by adding a digital signature to outgoing emails. It’s like a ‘proof of authenticity’ stamp for your messages. DKIM relies on asymmetric cryptography to verify the integrity and authenticity of email messages. 

Asymmetric Encryption: DKIM uses a pair of keys: a public key and a private key.

The private key is used by the sending mail server to create a digital signature for certain parts of the email (e.g., headers and/or the body).

The public key is published in the DNS records of the sending domain, allowing receiving servers to verify the signature. 

• The primary goal of DKIM is to ensure the integrity and authenticity of the email. It helps verify that the email has not been tampered with during transit and that it was sent from an authorized source for the domain. 

• It does not provide confidentiality. DKIM does not encrypt the email contents; the email remains readable to anyone who intercepts it during transit.  

• If confidentiality is required, encryption protocols such as TLS (for securing email in transit) or PGP/SMIME (for end-to-end encryption) should be used alongside DKIM. 

Implementing DKIM involves several steps, typically completed by a domain administrator or email server manager. Here's a breakdown of the process: 

1. Generate DKIM Keys

• What: Create a pair of cryptographic keys (private and public). 

• How: Most modern email systems provide tools to generate these keys. You can also use command-line tools like openssl to create them manually. 

• Key Requirements: 

• Key size: Typically 1024-bit or 2048-bit (2048 is preferred for better security). 

• Save the private key securely; it will be used by your email server to sign outgoing emails. 

• The public key will be published in your DNS record. 

2. Create a DKIM DNS Record

• What: Publish the public key in the DNS record of your domain. 

• How: Add a new DNS TXT record for your domain. The record contains: 

• A selector: A unique identifier that allows multiple keys to be used for different purposes or periods. (E.g., default, mail1, etc.) 

• The public key: This will allow receiving servers to verify your email signatures. 

3. Configure Your Email Server

• What: Set up the server to use the private key for signing outgoing emails. 

• How: The process depends on your email server: 

• For Postfix: 

Install opendkim (a DKIM signing service). 

Configure opendkim with your private key and selector. 

Link opendkim with Postfix. 

• For Microsoft Exchange: 

Use third-party DKIM tools like DKIM Exchange or native configurations (in newer versions). 

• For Gmail/Google Workspace: 

Upload the private key in the admin console under the Authenticate Email section. 

The server will use the private key to generate a DKIM signature for specified email headers and attach it to each outgoing email. 

4. Test Your DKIM Setup

• What: Verify that DKIM is configured correctly. 

• How: Send a test email to a tool like Mail Tester or DKIM Core Validator.
• Check for DKIM results in email headers. Look for something like:

Authentication-Results: dkim=pass (signature verified) header.i=@example.com 

5. Monitor and Maintain

• What: Ensure your DKIM setup works consistently. 

• How: Regularly monitor your DNS records and email logs.

• Consider enabling DMARC to combine DKIM with SPF (Sender Policy Framework) for better email security. 

• Rotate your DKIM keys periodically (e.g., every 6-12 months) to maintain security. 

1. Outgoing Mail: 

• The email server signs outgoing emails using the private key. 

• Adds the DKIM signature in the email header. 

1. Receiving Mail: 

• The recipient server retrieves the public key from your domain's DNS. 
• Verifies the signature against the received email.
   

By following these steps, your emails will be signed with DKIM, boosting trustworthiness and helping prevent spoofing. 

By avoiding these common mistakes, you can ensure your DKIM setup is robust and effective in verifying the integrity and authenticity of your emails.  

1. Selector: 
   A unique identifier in the DKIM DNS record that helps differentiate multiple DKIM keys for the same domain. Example: A domain might have a selector called default for its primary key and backup for a secondary key. 

1. Base64 Encoding: 
   A method for encoding binary data (such as cryptographic keys) into a readable string format that can be safely used in DNS records or email headers. 

1. SPF (Sender Policy Framework): 
   An email authentication protocol that specifies which mail servers are authorized to send emails on behalf of a domain. SPF works in tandem with DKIM and DMARC to prevent email spoofing. 

1. rsa-sha256: 
   A cryptographic algorithm used by DKIM to sign emails. It combines RSA encryption with the SHA-256 hashing function for secure and tamper-proof signatures. 

1. DNS Propagation: 
   The time it takes for changes to DNS records (like adding a DKIM public key) to be updated across the internet. This delay can range from a few minutes to 48 hours. 

1. DMARC (Domain-based Message Authentication, Reporting, and Conformance): 
   A protocol that builds on DKIM and SPF by providing a way for domain owners to instruct receiving servers on how to handle emails that fail authentication.