DomainKeys Identified Mail (DKIM)
Security+ 🏆 • Email Security 📧 • Protocols 🔗
•
Difficulty: premium
Definition
DKIM is an email authentication method that adds a digital signature to outgoing mail. Receiving servers use a public key published in DNS to verify the message was authorized by the sending domain and was not meaningfully altered in transit.
Examples
- A company enables DKIM on Microsoft 365 so recipients can verify emails claiming to be from the company were actually signed by its domain.
- A helpdesk platform signs outgoing ticket updates with DKIM so customers can trust the message content was not tampered with.
Discover 🔎
Email was designed to be flexible and interoperable, not secure by default. That means it is easy for attackers to impersonate domains unless the domain proves it authorized the message. DKIM is one of the main ways a domain proves that authorization. It works like a tamper-evident seal: the sender signs the email, and the receiver checks that signature using a public key published in DNS.
Remember: DKIM proves the message was signed by a domain and has not been changed in important ways. It does not, by itself, guarantee the visible sender identity matches what the user sees.
Tip: The interactive version includes progress tracking, decks, and premium deep dives.