Digital Lexicon Hub

An email authentication standard that adds a cryptographic signature to messages so receivers can verify the signing domain and detect changes.

DKIM gives mailbox providers a verifiable domain identity on which to build sender reputation, and it is required for bulk sending to Gmail and Yahoo, so missing or misaligned signatures reduce inbox placement.

An admin generates a 2048-bit DKIM key in Google Workspace with the selector google, publishes it as a TXT record at google._domainkey.example.com, starts signing once it propagates and adds a separate selector for the marketing platform.

DKIM proves which domain signed a message, not that the content is safe or that the visible From address matches. Signatures can break when mailing lists or security gateways modify messages, and private keys need protection and rotation.

Under RFC 6376 the signer adds a DKIM-Signature header with the signing domain (d=), a selector (s=), the signed header list (h=), a body hash (bh=) and the signature (b=). The receiver fetches the public key from a TXT record at selector._domainkey.domain and verifies the signature. Simple or relaxed canonicalization sets how much whitespace and header change is tolerated, and rsa-sha256 is the required algorithm. DMARC checks that d= aligns with the From domain.