What is a DKIM signature?

Every email you send has a hidden stamp of authenticity attached to it. That stamp is the DKIM signature, and it's how receiving mail servers confirm that your message wasn't tampered with and actually came from your domain.

DomainKeys Identified Mail (DKIM) works by adding a special header called DKIM-Signature to every outgoing message. Inside that header, you'll find:

• The signing domain (d= tag)
• Which headers were signed
• A hash of the message body
• The cryptographic signature itself

When a receiving mail server gets your email, it looks up your public key in DNS and uses it to verify the signature. If it checks out, the message passed DKIM. If the signature is missing or broken, the message fails the check.

The DKIM record in DNS has tags of its own, and they are not the same as the tags in the signature. A DKIM record's h= tag says which hash it allows. If it does not allow sha256, receivers cannot use the key, because sha1 is no longer allowed for DKIM. This is different from the h= in a signature, which lists the signed headers.

A DKIM record's s= tag says which services the key is for. If it does not include email or *, receivers ignore the key for mail. This is different from the s= in a signature, which names the selector.

A missing DKIM signature doesn't automatically send email to spam. But it does mean the receiving server has no cryptographic proof that the message is legitimate. That matters when you're trying to build a trustworthy sending reputation. Combined with SPF and DMARC, DKIM forms the authentication trio that mailbox providers rely on to trust your email.

You can verify your DKIM setup in seconds with our free DKIM checker. If you're not sure what you're looking at in the results, check out our guide on setting up DKIM.