DomainKeys Identified Mail (DKIM)

A DKIM signature is an encrypted header that is added to emails. This header provides details that enable a recipient mail server to validate an email by looking up the sender’s public DKIM key and verifying the encrypted signature with it. Here is an example of a DKIM signature:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sparkpost.com; s=google;
h=from:content-transfer-encoding:subject:message-id:date:to:mime-version;
bh=ZkwViLQ8B7I9vFIen3+/FXErUlKv33PmCuZAwpemGco=;
b=kF31DkXsbP5bMGzOwivNE4fmMKX5W2/Yq0YqXD4Og1fPT6ViqB35uLxLGGhHv2lqXBWwFhODPVPauUXaRYEpMsuisdU5TgYmbwSJYYrFLFj5ZWqZ7VGgw6/nI1hoPWbzDaL9qh

 Read more on DKIM Signature

The following points describe the DKIM’s relationship with SPF and DMARC:

• Through SPF, senders can specify which IP addresses are allowed to send emails using a specific domain.
• DKIM provides an encryption key as well as a digital signature that ensures that an email message is not forged or tampered with.
• DMARC combines SPF and DKIM authentication procedures and allows domain owners to specify how an email from their domain should be handled if it fails authentication.

For email receivers, the key benefit is that DKIM allows the signing domain to accurately identify a stream of legitimate emails, making domain-based blacklists and whitelists more effective. It also makes it easier to identify certain types of phishing attacks:

• Spam filtering
  DKIM can help identify mail that isn’t known to be spam and does not need to be filtered. If a receiving system maintains a whitelist of authentic sending domains that can be kept locally or obtained from third-party certifiers, it can skip the filtering of signed emails from those domains and filter the remaining emails more aggressively.
• Compatibility
  DKIM is compatible with existing email infrastructure because it is implemented using DNS records and an extra RFC 5322 header field. It is especially apparent to existing email systems that do not support DKIM.
• Anti-phishing
  DKIM can be used to defend against phishing attacks. Mailers in intensively phished domains can sign their emails to prove their authenticity. The absence of a valid signature on an email from these domains can be interpreted by recipients as a clue that the email is most likely forged.
• Non-repudiation
  The non-repudiation feature of DKIM does not let senders deny that they have sent an email. This has been essential to news organizations as they have been able to use DKIM body signatures to confirm that leaked emails were authentic and untampered with.

Nothing is ever flawless, and nothing can genuinely guarantee total security. DKIM records, too, have a few drawbacks.

• The message envelope that contains the return path and message recipients is not covered by DKIM signatures.
• Because DKIM does not sign all sections of the message and only authorizes certain headers, malicious actors can forge the email by adding more header fields.
• The information validated by DKIM is only on the server-side. End users do not benefit much from the fact that an email is validated by DKIM.

DKIM configuration has three simple yet major steps.

• Generate a public domain key for the concerned domain.
• Add the public key to the DNS entries for that domain. This key can be used by email servers to validate DKIM signatures in your messages.
• To begin applying a DKIM signature to all outgoing messages, enable DKIM signing.

 For detailed information check DKIM Setup Guide

 To validate your DKIM signature, head to EmailAuth’s DKIM Record Checker

A DKIM check fails when the DKIM authentication fails. A DKIM check failure occurs when:

• The sender’s domain and the DKIM signature domain do not match.
• The DKIM public key entry in DNS is either inaccurate or non-existent.
• The DNS zone for the sender’s domain is unavailable for lookup.
• The DKIM key, which is used for signing, is too short.
• The email body is altered during the auto-forward process.