The DKIM Record

is a mechanism to verify the source of a message. It uses public-key cryptography to sign the contents of your email so that anyone who receives it can check whether it has been tampered with in transit. The DKIM record syntax of your TXT record Name is selector._domainkey.example.com. In our example, the selector is the DKIM-signer, which means that we’re signing for the domain example.com.

What is a DNS DKIM Record? 

A DKIM record is an entry in your DNS that tells other mail systems how you want your mail to be authenticated. It includes information like your record name, how long you want the record to live, and what key you want to use. 

If a sender wants to send you an email message with DKIM authentication, they will generate an encrypted hash of their message. They then include this cryptic code as part of the header when they send it out so recipients can verify whether or not the message has been tampered with since it left the sender’s server.

How does DKIM authenticate emails? 

DKIM uses public key cryptography to digitally sign each outgoing email message with its own private key, which is then verified by the receiving server with its public key. The signing process adds a DKIM Signature header field to your email headers which includes information about the email’s source and destination domains, along with a hash of the original message body together with some other details about how it was encrypted and signed.

The receiving server then decodes this information using its public key and compares it against any signatures it has cached for those domains in order to verify whether or not they match up. 

Breaking down the DKIM Record Syntax

Let’s first take the example of a DKIM record: 

Record Name: The Name field in your DKIM record syntax is made up of two parts: a DKIM selector and a domain. The selector is a unique string that identifies the sending domain and helps locate the public key published on the domain’s DNS during a DKIM lookup, and it must be unique across all DKIM signing domains. The domain is the address of your DNS record.

Record Type: This field refers to the resource type of your DKIM record syntax. It may be TXT

(text) record, it can also be a CNAME (canonical name) record depending on your provider. 

TTL: The time-to-live for your record, measured in seconds, is the amount of time the record remains valid per session before it expires or gets refreshed. 

Value: Finally, the DKIM value is your public key that is matched against your private key (the signature key in your email header) to authenticate your emails. 

DKIM Email Header Debunked 

v=DKIM1; a=rsa-sha256; 

      d=example.com; s=s1;

      h=from:to:subject;

      bh=YzJFQUFBQURBUUFCQUFBQWdRQ1kwK3piQ0NlSURzOHYvYTQ=; b=AptMld5a1djOUJva1hKWjBkYys5MW5FVXNYRUNvSXJZK0pSdGhVaDRDekNjZ2dEQWJ6RFl1QmVWNkgvN3l1M3drdVllSjVjK0gKSHdKQUtzSk1NNDNBZzdLUERXNFZ0K0lqa3pXWStKck56b3UvalFQbGk1M3MxVTF2c0krOElFSW80ci9xM3ZHd3crc2xOdmRjCkc5L1hnZWlvajJMaktJaHN5QT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

A DKIM signature is a digital signature (b= tag) that can be used to verify the authenticity of an email message, as well as its content.