DKIM
Definition
DomainKeys Identified Mail. A cryptographic signature placed in a DKIM-Signature header. The signing key sits on the sending server; the public key is published in DNS. The receiver verifies the signature against the public key.
- Full name
- DomainKeys Identified Mail
- Mechanism
- Cryptographic signature in DKIM-Signature header
- Private key location
- Sending server
- Public key location
- DNS record
Common questions
What does a passing DKIM check actually prove for an investigator?+
It proves the signed portions of the message were not altered after the signing server processed them and that whoever holds the private key authorised the signature, but it does not by itself prove the visible From address is genuine unless paired with alignment checks like DMARC.
Can a spoofed email still pass DKIM?+
Yes, if the attacker controls a domain and signs the message with that domain's valid key, DKIM will pass for that domain even though the visible sender name may be forged to impersonate someone else, which is why header analysis looks beyond DKIM alone.
Related terms
- DMARC
- Domain-based Message Authentication, Reporting and Conformance. A DNS policy that stacks on top of SPF and DKIM, telling receivers what to do...
- MTA
- Mail Transfer Agent. The server that relays mail server-to-server. Postfix, Exim, Sendmail and Microsoft Exchange are the common implementations. Speaks SMTP.
- MUA
- Mail User Agent. The client the user sees. Outlook, Thunderbird, Apple Mail, Gmail web, Spark, mobile apps. Speaks SMTP outbound and IMAP...
- Received Header
- A header line prepended by each mail server that accepts a message in transit, recording the server's own identity, the IP or...
- SPF
- Sender Policy Framework. A DNS TXT record on the sender domain that lists the IP addresses authorised to send mail for that...