Quick Answer: DKIM (DomainKeys Identified Mail) is an email authentication standard that attaches a cryptographic signature to outgoing email messages. The private signing key is held by the sending mail server; the corresponding public key is published in DNS. Receiving mail servers use the public key to verify the signature, confirming the email was sent by an authorised server and that the message content was not tampered with in transit.
How does DKIM work?
- The sending mail server signs the email headers and body using a private key, generating a
DKIM-Signature header
- The signature includes a reference to the DNS location of the corresponding public key (the
d= domain and s= selector)
- The receiving mail server retrieves the public key from DNS at
[selector]._domainkey.[domain]
- It uses the public key to verify the signature — confirming authenticity and integrity
What does missing DKIM mean?
Without DKIM, email from your domain cannot be cryptographically verified by recipients. This:
- Weakens DMARC enforcement — DMARC relies on either SPF or DKIM passing for alignment. Without DKIM, SPF alignment is the only option.
- Increases the risk that legitimate email is treated as spam by receiving servers that weight DKIM signatures in spam scoring
- Means email content can be modified in transit without detection
What are common DKIM issues?
- Missing DKIM record — no DKIM public key published in DNS for the selector used by the sending server
- Weak key length — DKIM keys shorter than 1024 bits are considered weak; 2048 bits is recommended
- Expired or rotated keys — if keys are rotated without updating DNS, DKIM verification fails for email signed with the old key
What are common questions about DKIM?
What does DKIM mean in cybersecurity?
DKIM describes a security concept that affects how teams understand, monitor, and reduce external exposure across internet-facing assets.
Why does DKIM matter for external attack surface monitoring?
It matters because attackers continuously inspect public assets. Tracking this concept helps teams reduce exploitable exposure before it becomes a breach path.
How does VeilScan help with DKIM?
VeilScan discovers public assets, validates findings with proof, prioritises issues by business impact, and explains remediation in reports built for engineering and leadership.
What related terms should you read next?