DomainKeys Identified Mail
DKIM links signed email components to a domain. A valid signature establishes neither encryption nor the person behind the message.
DomainKeys Identified Mail, or DKIM, associates a message with a signing domain through a cryptographic signature. The receiving side can check the signature using that domain’s public key. The domain appears in the signature’s d= field.
Examine a signature along the sending route
In the fictional design, a portal creates message D-455. A downstream service then adds a notice. For the test, the team records when signing occurs and whether the added text changes signed components. Checking takes place with an approved test message at the end of this route.
An error should first be traced to this specific workflow. Turning off the signature mechanism across the board would not explain where the sending route departs from the intended behaviour.
Interpret the result correctly
A valid check concerns the components covered by the signature and the signing domain. DKIM does not encrypt the content. The signing domain itself need not match the visible sender either; DMARC adds domain alignment. For the portal, identifying the person and authorising the triggered action remain separate application questions.
Sources
Related terms
- Email deliverabilityDeliverability is about whether expected email actually reaches the inbox. Check sending status, authentication and actual receipt separately.
- DMARCDMARC links a successful SPF or DKIM check to the visible sender domain. Policy and reports help with its technical oversight.
- TXT recordA TXT record stores text in DNS. The relevant procedure determines how a service interprets it, for example when checking control of a domain.
- Sender Policy FrameworkSPF checks a sending server’s authorisation to use an SMTP domain. The visible sender line and receipt are separate questions.
Articles on this topic
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.