Paul O'Brien - Insights

DKIM Proves Message Integrity — Not Sender Identity

DKIM (DomainKeys Identified Mail) doesn’t verify who sent an email. It verifies that the message hasn’t been altered since it was signed, and that a domain takes responsibility for its contents. Understanding DKIM means understanding what it proves — and what it deliberately ignores.

Paul O'Brien
Paul O'Brien
– 3 min read

DKIM (DomainKeys Identified Mail) is often incorrectly described as a way to "verify the sender" of an email. That description is incomplete. DKIM does not confirm that the visible From: address belongs to a real person, business, or brand.

Instead, DKIM functions as a cryptographic tamper seal: it proves that a message has not been modified since it was sent, and that a specific domain takes responsibility for that exact payload.

In Plain English: What is DKIM?

Think of DKIM like a tamper-evident seal on a medicine bottle or a wax seal on an old letter.

When an email is sent, the sender applies an invisible digital seal to the message. When it arrives in your inbox, your email provider checks whether that seal is still intact.

If the seal is unbroken, it proves two things:

  • It hasn't been modified: Nobody altered the message text or added bad links while it was in transit.
  • It's officially signed: The domain claiming to send it takes explicit responsibility for the exact text inside.

What it does not prove is that the sender is friendly, honest, or safe—only that the message arrived exactly as it was originally sent.

What DKIM Actually Checks

When a message is sent, the originating server attaches a cryptographic signature to the email header.

DKIM-Signature: v=1; d=example.com; s=selector1; h=from:subject:date; bh=47DEQpj8HBSa+/TImW+5JCeuQeR...; b=kJ3a...

The verification process follows four deterministic steps:

  1. Header Selection: The sending server selects specific headers and the message body payload.
  2. Cryptographic Hashing: The server generates a cryptographic hash of that data.
  3. Private Key Signing: The sending domain signs the hash using a private key.
  4. Public Key Verification: The receiving server queries the DNS for the domain's public key (published at selector._domainkey.domain.com), recalculates the hash, and verifies the signature.

DNS Zone file

selector1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

If the calculated hash matches the signature, DKIM passes. If the body or signed headers were altered in transit, DKIM fails.

What DKIM Ignores

A passing DKIM check provides zero guarantee of message safety or sender legitimacy.

DKIM Verifies What DKIM Completely Ignores
Payload immutability since signing Validity of the human-readable From: header
Cryptographic domain responsibility Reputation or safety of the signing domain
Signature math alignment Intent (e.g., phishing links, malware attachments)

Phishing emails can be—and frequently are—fully DKIM-signed. If an attacker registers a throwaway domain and signs malicious content without altering it during delivery, the DKIM check passes cleanly.

Common Causes of DKIM Failures

Because DKIM demands strict cryptographic immutability, benign operational changes can break validation silently:

  • Mailing Lists & Gateways: Adding footers, disclaimers, or unsubscribe links modifies the body payload.
  • Forwarding Services: Subject modifications or content re-encoding alter signed headers.
  • Security Middleware: Inbound email security appliances inserting warning banners break the original body hash.
  • DNS Misconfigurations: Expired keys, missing selectors, or malformed TXT records prevent receivers from fetching the public key.

The Email Authentication Ecosystem

DKIM does not operate in isolation. It acts as a single telemetry signal alongside SPF and DMARC:

+-------------------------------------------------------------+
|                            DMARC                            |
|  (Aligns identities, enforces policy, & reports failures)   |
+------------------------------+------------------------------+
                               |
               +---------------+---------------+
               |                               |
    +----------v----------+         +----------v----------+
    |         SPF         |         |         DKIM        |
    |  (Verifies sending  |         | (Verifies payload   |
    |     server IP)      |         |     integrity)      |
    +---------------------+         +---------------------+

The three pillars of email authentication: SPF and DKIM act as foundational verification signals, while DMARC evaluates alignment and enforces policy.

Without DMARC enforcement, a DKIM signature simply proves that a domain signed the payload—not that it belongs to the brand displayed in the recipient's inbox.

Summary

DKIM is not an identity badge or security approval stamp; it is a mechanical integrity check. It answers whether a message arrived unmodified and which domain signed it. Connecting cryptographic integrity to user-visible trust requires pairing DKIM with SPF under an enforced DMARC policy.

For technical specifications, key syntax, and verification algorithms, consult the official documentation at dkim.org.

You might also like