What is DKIM? Email signatures explained simply

How it works

The sending server signs parts of the header and the body and adds the result in a DKIM-Signature header. The signature names the signing domain (d=) and a selector (s=).

The receiver looks up the public key at selector._domainkey.domain and verifies the signature. If the signed content was changed in transit, verification fails.

The From header must always be signed. But DKIM itself does not require the signing domain to match the From domain. Checking that match is DMARC's job.

Why it matters for newsletters

Google requires SPF or DKIM from every sender, and both from senders of more than 5,000 messages a day to Gmail accounts. Mail to personal Gmail accounts needs a DKIM key of at least 1024 bits.

One-click unsubscribe (RFC 8058) also depends on DKIM: the signature must cover the unsubscribe headers.

How to check it

• Open a message you sent and view the original source. Look for dkim=pass in Authentication-Results.
• Check that d= in DKIM-Signature is your domain, or a domain in the same organization as your From address.
• Use a domain checker to confirm the selector's public key is published in DNS.

Email newsletter glossary

• What is SPF? Sender Policy Framework explained simply
• What is DMARC? Email spoofing protection explained simply
• What is double opt-in? Confirmed subscriptions explained
• What is a preheader? The preview text next to your subject line
• What is a hard bounce? Undeliverable email explained
• What is one-click unsubscribe? RFC 8058 explained simply
• What is CAN-SPAM? The U.S. email law explained simply