DKIM stands for DomainKeys Identified Mail. It lets a sending system add a cryptographic signature to an email so the receiver can verify that signed parts of the message have not been altered and that the signer controls the corresponding DNS public key.
DKIM complements SPF because it authenticates a signature associated with the message rather than relying only on the server that delivered it.
The sending service signs selected message headers and a body hash with a private key. The DKIM-Signature header identifies the signing domain and selector. The receiving system uses those values to look up the corresponding public key in DNS and verify the signature.
A successful verification shows that the signature is valid for the signed content and key. It does not by itself prove that the visible From domain is the same as the signing domain.
A selector is a label that tells the receiver which DKIM public key to query for a signing domain. A domain can use different selectors for different services or key generations.
Selectors also support key rotation: a new selector and public key can be introduced while an older selector remains available for messages still in transit or for a controlled transition.
For DKIM to satisfy DMARC, the DKIM signing domain must align with the domain visible in the From address. A valid signature from an unrelated service domain can verify successfully yet remain unaligned for DMARC.
Aligned DKIM OR aligned SPF can satisfy DMARC. Using both gives legitimate mail more than one possible authentication path.
A DKIM signature can fail if the public key is unavailable, the wrong selector is referenced, the key configuration is incorrect, or a mail system modifies signed message content in a way that invalidates the signature.
Troubleshooting should distinguish a missing signature, a cryptographic verification failure and a valid but DMARC-unaligned signature.
Use the matching ScoutLab checker with only a domain name. No signup or email address is required.
ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.
Run the free website security checkA DKIM selector is a label included in the DKIM signature that helps the receiving server locate the correct public key in DNS. Domains can have multiple selectors for different sending services or key rotations.
The DKIM public key is published in DNS and corresponds to the private key used by the authorised sending system to create the DKIM signature. Receivers use the public key to verify that signature.
Yes. DKIM and SPF are independent mechanisms. For example, forwarding can cause SPF to fail while an intact DKIM signature continues to verify. If that DKIM signing domain also aligns with the visible From domain, it can satisfy DMARC.
SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.
