DNS & Glossary

DKIM (DomainKeys Identified Mail)

Cryptographic signing of outgoing mail, with the public key published in DNS, so receivers can verify a message truly came from your domain and was not tampered with.

What it is

The sending server signs each message and adds a DKIM-Signature header; the receiver fetches the public key from <selector>._domainkey.<domain> in DNS and verifies it. This proves integrity and domain ownership, and — like SPF — feeds DMARC alignment.

DNS TXT (selector)
s1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

Why it matters

  • It cryptographically ties a message to your domain, resisting forgery and tampering.
  • Selectors allow multiple keys and clean key rotation.

Common mistakes

  • Publishing the wrong or truncated public key, so verification fails.
  • Not rotating keys, or leaving old selectors that never expire.

How WebInspect checks this

  • The Network Inspector checks common DKIM selector paths and reports key presence and validity.