DKIM is short for DomainKeys Identified Mail. It is an email authentication protocol that a domain owner implements so that the receiving mail server can verify whether someone has altered the message content in transit. DKIM is very sensitive to alterations, so even an extra space or character can cause authentication to fail.

Implementing DKIM ensures that your business, customers, and employees are protected from email-based threats, especially the ones attempted by tampering with the content.

DKIM definition

DKIM is a protocol that allows domain owners to take responsibility for sending emails by signing them digitally. With DKIM, a digital signature is attached to each outgoing email. This digital signature is linked to your organization’s domain, allowing recipient mail servers to verify that the email content has not been altered during transit. DKIM helps prevent email phishing, spoofing, spam, and ransomware attacks by providing a method to validate a domain name associated with a message through cryptographic authentication.

How does DKIM work?

There are three primary steps involved in the DKIM process. Firstly, the sender has to identify what fields they want to include in their DKIM record signature. These fields are ‘from’ address, email body, subject line, etc. These fields have to remain unaltered when they reach the recipient’s mailbox; if there are any changes, DKIM authentication will fail.

Next, the sender’s mailbox creates a hash of the text fields included in the DKIM signature. Hash is a fixed-size string of characters generated by applying a hash function to the email’s content.

For example, the following text fields;

From: Domain Owner (domain.owner@example.com)

Subject: Test email

Will map to this hypothetical hash string-

9e107d9d372bb6826bd81d3542a419d6

Once the hash string is produced, it is encrypted with a private that only the sender can access.

Lastly, once the email goes out of your mailbox, the email gateway or recipient’s mailbox validates the DKIM signature by retrieving the public key from the corresponding DKIM record and matching it with the private key. It’s in this stage that the DKIM signature is decrypted back to its original hash string.

The recipient’s server creates its own hash of the email’s signed fields and compares it to the decrypted hash from the DKIM signature. If both of them match, it’s confirmed that the email content was not altered during transit and that the sender’s domain is legitimate.

Steps to implement DKIM?

To implement DKIM for your domain, you have to generate a unique cryptographic signature and add it to your DNS. This isn’t as easy as it sounds, so here are the detailed steps-

Step 1: Generate a pair of public and private keys

Use an online tool to generate a pair of cryptographically secured public and private keys. The private key is stored securely on your email server and is used to sign every outgoing email. The public key is published on your domain’s DNS record and is available for public retrieval so that the receiving mail servers can verify if the messages have been tampered with in transit.

Step 2: Publish the public key in DNS

Add the DKIM record containing the public key to your domain’s DNS. A DKIM record also includes a selector, which helps the receiving server determine the specific public key in use (this is explained later in the blog).

Step 3: Configure your email server to sign outgoing emails

Set up your email server to attach DKIM signatures to all outgoing emails. This involves:

• Selecting headers to sign: Choose which all parts of the email header you have to include in the signature.
• Creating the signature: Generate a hash of the selected headers and encrypt it using your private key.
• Adding the signature to the email: Insert the DKIM signature into the email’s header before sending.

The specific configuration steps may vary depending on your email server software.

Step 4: Verify your DKIM setup

Once you are done setting up DKIM for your domain, run your DKIM record through a credible online lookup tool. The tool works by sending test emails to ensure recipients can successfully verify the DKIM signatures. If any issues are detected, fix them immediately and retest.

What is a DKIM selector?

Domain owners are advised to generate multiple DKIM keys and keep rotating them. This is a safety practice as it ensures that even if a threat actor has compromised the key, they can’t exploit it for long.

Now, the role of a DKIM selector is to help the receiving server locate the public key currently being used by the sender. When an email is sent, the sender’s mail server includes this selector in the email’s header as part of the DKIM signature. This way, the domain owner can manage multiple keys simultaneously, helping in key rotation and letting different keys be used for various email services or departments.

Components of a DKIM record

A DKIM record is composed using several tags, each helping in the email verification process. The primary DKIM tags are-

• v= This tag tells the DKIM version being used. (for example, v=DKIM1).
• k= It specifies the key type, which helps know the algorithm used (commonly k=rsa).
• p= It indicates the public key.
• h= This tag specifies the hash algorithm that is being accepted and used in conjunction with the key (for example, h=sha256).
• n= This includes notes or comments about the key or the way it’s in use.

Why implement DKIM?

There are several benefits of implementing DKIM for your domain. Here are the distinct ones-

1.    Improved email deliverability

With DKIM, every outgoing email is linked to a digital signature that helps email service providers run authentication checks to know that your messages are legitimate. This way, there are fewer chances of emails getting marked as spam. It simply means that most of the emails you will send will land in the primary inboxes of the intended recipients. When more emails reach recipients’ inboxes, engagement rates for campaigns increase.

2.    Protection against email spoofing

DKIM functions as a mechanism that helps receiving mail servers verify if the emails are genuinely sent by you and that no one has tampered with them in transit. This cryptography-based authentication stops malicious actors from exploiting your domain to send phishing and spoofing messages in the name of your business. Emails that don’t pass the DKIM checks are subjected to the selected DMARC policy (none, quarantine, or reject).

3.    Improved sender reputation

Internet service providers consider you a trustworthy sender if your emails are consistently signed by DKIM. This enhances your sender reputation, which leads to better email deliverability over time. Authenticated messages have better chances of passing spam filters and reaching the inboxes of the right audience.

4.    Alignment with industry best practices

Today, most industries require companies to adopt email authentication protocols for security. This proactive approach not only enhances security but also signals to partners and customers that you are committed to maintaining robust email practices, fostering trust and credibility in your communications.

I write professional technical blogs that translate the same tricky, technical messages but in easy-to-grasp words. I can help your website be on the top of the search results so that your sales game takes a giant leap. If you are looking for a freelance cybersecurity writer for your business, please reach out to me at daksh@turtlewords.com.