What is DKIM? How to add a DKIM record?

Prerequisites

Before you begin, understand the basics covered in What is DNS?

What is DKIM?

DomainKeys Identified Mail (DKIM) is an email authentication method that detects forged and tampered emails. Senders attach a digital signature to prove the email originated from the claimed domain and was not altered in transit.

Get the DKIM record value

1. Log on to the management console as a mailbox administrator. Go to Enterprise Customization > Domain Management > Domain Settings and click View Details.

2. Click Copy to get the DKIM record value.

   

   Note

   • The host record and record value are unique to each domain. Obtain them from your mailbox management console.

   • The encryption bit length can be 1024 or 2048. Select a value based on your domain management platform requirements. Most platforms support both. If you change the bit length, the previous record value becomes invalid. Update your DNS configuration with the new record.

Add a DKIM record to DNS

The following steps use Alibaba Cloud DNS as an example. If you use a different DNS provider, refer to that provider's console.

1. Log on to the Alibaba Cloud DNS console.

2. Click the domain name to open the DNS Settings page.

3. On the DNS Settings page, click Add Record to add a TXT record.

4. Set the host record to default._domainkey.

5. Set the TXT record value to v=DKIM1; g=*; k=rsa; p=... . Note that the record must be on a single line. Example DKIM record configuration:

DKIM signature syntax

When DKIM is enabled, the sending server adds a DKIM-Signature header to each email. This header contains the digital signature (generated with a private key) and the selector (a string identifier used to locate the corresponding DKIM public key in DNS).

Example DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=default; c=relaxed/relaxed;
h=from:to:subject:date:message-id; i=@example.com;
bh=...; b=...;

In this header:

• v=1 indicates the DKIM version.

• a=rsa-sha256 indicates the signature algorithm.

• d=example.com indicates the sending domain.

• s=default indicates the selector used for the signature.

• c=relaxed/relaxed indicates the canonicalization algorithm.

• h=from:to:subject:date:message-id indicates the signed header fields.

• i=@example.com indicates the signing identity.

• The part after bh= is the hash of the email body.

• The part after b= is the signature itself.

The receiving server inspects the DKIM-Signature header and extracts d= (domain) and s= (selector) to determine which DNS record to query for the public key.

For example, with d=example.com and selector default, the DNS query is:

default._domainkey.example.com

The server retrieves the public key from this DNS record and validates the signature in b=. A successful validation confirms the email is from the claimed domain and was not altered in transit.

If a domain has multiple sending sources, each source should use a different selector so that receivers can locate the correct public key from each email's DKIM-Signature header.