Definition
DKIM (DomainKeys Identified Mail): An authentication method (RFC 6376) in which the sending server signs chosen headers and the body with a private key. Receivers fetch the public key from a TXT record at <selector>._domainkey.<domain> and confirm the signature; the d= tag names the domain taking responsibility.
How DKIM signing and verification work
The sending server hashes the body, then signs that hash together with a chosen set of headers, always including From, using a private key. It adds the result as a DKIM-Signature header with tags such as d= (the signing domain), s= (the selector), h= (the signed headers), bh= (the body hash) and b= (the signature).
The receiver reads d= and s=, fetches the public key from the TXT record at selector._domainkey.domain, and checks the signature. The outcome is recorded as dkim=pass or dkim=fail in the Authentication-Results header.
What breaks a DKIM signature
Any change to the signed content. Mailing lists that add a footer or tag the subject, security gateways that rewrite links, and forwarders that re-encode the message all break the signature.
Key problems break it too: a selector record deleted while mail signed with it is still in flight, a key published with a typo, or a key that is too short. RFC 8301 requires RSA keys of at least 1024 bits and recommends 2048.
How to rotate DKIM keys
Publish the new key under a new selector, switch signing to it, and leave the old selector in DNS for a while so messages still in queues or forwarding chains can be verified. Then remove the old one.
Using a new selector name for each rotation, such as one per year, keeps the old and new keys from ever colliding.
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s2026;
h=from:to:subject:date:message-id; bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=;
b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD00lszZVoG4ZHRNiYzR...
s2026._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."How RocketVerifier handles it
Our free DKIM checker finds the public key for any selector and domain and checks its key type and length. The email header analyzer reads the DKIM, SPF and DMARC results from a message you received, and the email deliverability checker scores all three for a domain in one pass. Monitors recheck SPF, DKIM, DMARC and blocklist status on a schedule and alert you when something breaks.