DKIM is an email authentication standard that uses digital signatures and DNS records to verify that incoming messages originate from the domain they claim to represent. It addresses the longstanding lack of authenticity and integrity in traditional email delivery.
When it comes to email security, another way we could implement a certain amount of authenticity and integrity is by using DomainKeys Identified Mail, or DKIM. So let's take a look at DKIM and what it is.
Originally with email, we really didn't have much in the way of authenticity and integrity. That is, the mail system would just send things in clear text, and it really didn't matter where it came from. So it could come from domain.com, or it could come from some other relay server, and they could be sending that same mail, and then historically speaking, this server right here would just accept it and send it off to the user. But this causes problems, because a lot of users will then click on links, or they'll download programs, or it will cause some sort of malware issue. And so this could be really problematic.
One of the solutions to help fix this is DomainKeys Identified Mail, or DKIM. And essentially what happens is, as this mail gets sent, there's some special information that goes on this mail to help verify it. It gets sent over to this MTA at the example.com domain. And the example.com domain takes a look at this mail and does a check to verify its authenticity, making sure that it came from the correct domain, that the sender's domain on this email aligns with the actual message that comes in.
To really fully understand how DKIM works, we really have to understand a few concepts: what hashes are, what public key cryptography is, and what digital signatures are. Hopefully you have a little bit of background in these, but if not, I'm going to do a short review over hashes, public key cryptography, and digital signatures.
First, let's talk about a hash. The biggest thing you should know about a hash is essentially it creates a fingerprint of data. So we take some data — in this case right here, it's a message — we pump it into an algorithm, and out comes on the other side a fingerprint of that data. Now, just a little change on this document would cause a drastic change to this fingerprint. That's what makes a hashing algorithm really work well, is that it has this very unique fingerprint for the data that's put into it.
Public key cryptography, not to be confused with public key infrastructure, or PKI. PKI uses public key cryptography, but they're two different concepts. So public key cryptography is this idea that we have a public key and a private key. So whoever owns the private key keeps it extremely private. You don't ever want your private keys to get out. The public key could be sent off to whoever it is.
And this can do two things for you. Number one, if you want to send a secure message, an encrypted message, you could use the public key to encrypt that message, you could send it along its way, it would make it to the server, and the server could decrypt it, and no one else can decrypt it because they don't have the private key. So that's one way.
But the way we're going to use it in this lesson is kind of the opposite: that we're going to encrypt something with the private key and send it along its way. That means anybody could decrypt it, so it doesn't have any level of confidentiality. But whoever decrypts it with the public key — because anybody can have the public key — it essentially verifies the source. It verifies that it came from this private key. So we can do some verification that this public key is associated with this private key, and verify some sort of authenticity with that message, that it came from an authentic source.
Digital signatures use both hashing and public key cryptography. So what do digital signatures do? Well, it's a verification of, let's say, a message. So we've got a message here, and let's say we want to verify it. So what's going to happen is we're going to hash it. We're going to create a hash out — that means that special fingerprint right there. So now we've got a fingerprint that's unique to that document. The other thing we're going to do is we're going to take our private key, and we're going to encrypt the hash to create an encrypted hash. We'll take that encrypted hash and bundle it up with the message, and then we'll send it over to whoever is receiving this.
They're going to take that message — they have the message and now the encrypted hash that they have there. What they can do is they can do their own hash. So now they understand the fingerprint of what it should look like. They can decrypt it with the public key. So they decrypt the hash with the public key. Now, if these two match, then what essentially happens is that it confirms that this message, number one, has a level of integrity to it, that it has not changed, because the fingerprint has not changed. But another thing that's happened is that this has been encrypted, the hash has been encrypted with this private key that's associated with this public key. So it's a point of verification, it's an authenticity piece. You know that it came from the legitimate source.
So now we have that integrity piece, because if somebody changed it along the way, somebody changed this message, then that fingerprint would look different than the encrypted fingerprint. If it was sent by somebody else, they wouldn't have the private key, so then this encryption would look different, and then you would get a different fingerprint. So it helps with authenticity and integrity.
This is what DKIM uses to essentially create some sort of authenticity and possibly some integrity with the message. So what we can do is, there's aspects of an email that we can go through this process to send it over for that authenticity and that integrity piece. But the question is, well, yeah, sure, we've got the public key here, but how do we get that public key? What is the mechanism to get that public key and verify the domain? That's specifically what we're trying to verify. How do we verify this domain of this message that was sent over?
Well, think about what distributes domain information. DNS distributes domain information. So DKIM uses DNS. What we can do is we can take the public key and put it into DNS. This means that anybody has access to it. And if this checks out right here, where we have these two hashes matching, well, what that verifies is that this email has come from the correct domain. So it's a verification of the domain.
So this user right here sends it through the system. Then what happens at some point in time — and it really doesn't matter where this happens at, it could happen at any point in time before it leaves the domain — but what happens is this digital signature gets placed onto this email right here. And then that email gets sent across to this mail transfer agent right here, or it's somewhere over on this side, to do a check to verify this mail. All that they have to do is take that signature, download that public key record from the DNS server, and they can use it to do the check. And if that checks out, then they know that the DNS server for domain.com verifies that this message came from that domain.
I'm on Wikipedia on the article for DomainKeys Identified Mail, and it gives us a little extra information on here. If I scroll down, I can see the signature that actually gets placed inside the mail. So this is part of the mail message right here, and the information that goes into it. So that's what's being sent over. And there are different tags with this. So we can actually bring in different parts as part of the signature. And the reason why we'd want to maybe do that is for some sort of integrity piece for certain aspects of that mail. And some of them are optional, some of them are required. They're listed out here.
So then, if we scroll a little bit further down, for the verification process, this is the DNS record and what the DNS record would look like. So within this DNS record, this is the public key right there that goes out. So you can see it's a big long string of numbers and characters there. So that is what goes into this DNS record and is able to do this verification step.
So DKIM is what allows us to verify that the message that we're receiving is coming from the correct domain, using the DKIM record within DNS.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →