Skip to content
newsletter-marketing24.deLaw · Deliverability · Metrics

Last reviewed:

Translated from German; if the versions differ, the German version applies.

Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.

DKIM (DomainKeys Identified Mail)

In short: With DKIM, a mail server digitally signs outgoing messages on behalf of a domain. The domain publishes the matching public key in the DNS; the receiver uses it to check whether the signed parts of the email are unchanged since sending and which domain vouches for them (RFC 6376).

How DKIM works

The sending server calculates a check value from selected header fields and the body of the message, encrypts it with the private key and writes the result into the DKIM-Signature header field. Two tags in it matter most to senders:

  • d= names the signing domain, i.e. the domain that vouches for the message.
  • s= names the selector, a freely chosen label for a particular key.

From the two, the receiver builds the name under which it looks up the public key: selector, then _domainkey, then the domain (RFC 6376, Section 3.6.2.1). With the key, it verifies the signature. Because the signature travels inside the message, it can survive forwarding as long as the signed parts are not changed.

On key length, RFC 6376 requires signers to use RSA keys of at least 1024 bits (Section 3.3.3). For sending to personal Gmail accounts, Gmail likewise requires at least 1,024 bits and recommends 2,048 bits if the domain provider supports it.

How it differs

  • DKIM and SPF: SPF checks the delivering server against the envelope address; DKIM checks a signature in the message itself. SPF often fails with forwarding, DKIM does not necessarily.
  • DKIM and DMARC: For DMARC, a DKIM signature only counts if the domain in d= matches the visible sender domain (RFC 9989, Section 4.4.1). If a sending service signs only with its own domain, DKIM passes, but DMARC does not pass via DKIM.
  • DKIM and encryption: DKIM does not make the content unreadable. The signature only proves origin and integrity.

Easily confused

  • DomainKeys: This is the name of an older method (RFC 4870). According to RFC 6376, DKIM key records are compatible with those of DomainKeys in many cases (Appendix C.1); today, the term almost always means DKIM.
  • Several signatures: A message can carry several DKIM-Signature fields, for example from the sending service and from your own domain. For DMARC, one passed, aligned signature is enough.

Example

Shortened from the example in RFC 6376, Appendix A.2:

DKIM-Signature: v=1; a=rsa-sha256; s=brisbane; d=example.com;
     c=simple/simple; q=dns/txt; i=joe@football.example.com;
     h=Received : From : To : Subject : Date : Message-ID;
     bh=…; b=…

The receiver reads d=example.com and s=brisbane and looks up the key under brisbane._domainkey.example.com (Appendix A.3). For your own domain, the record in the DNS would look roughly like this, with the key shortened:

newsletter2026._domainkey.example.de.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

A quotation on proof

The German data protection authorities (Datenschutzkonferenz, DSK) mention DKIM in connection with proving consent. They write: “In this context (in the above-mentioned judgment), the BGH refers to the submission of a confirmation email sent from the email address in question, which – for example with the use of DKIM or other digital signatures, common nowadays – can actually prove the authenticity of the email and thus of the consent.” (DSK guidance on direct marketing, February 2022, section 3.3, p. 12, our translation; only the German wording is authoritative) The BGH is Germany’s Federal Court of Justice (Bundesgerichtshof). We give no legal assessment of our own on this.

Frequently asked questions

Where do I get the DKIM key? As a rule, the service that sends your emails creates it and gives you the name and content of the DNS record. Only the signing server needs the private key. For your own servers, Gmail refers to tools for creating DKIM keys or to the domain provider.

What does “dkim=pass” mean? With this note, the receiving server records in a header field that it has verified and confirmed a signature; RFC 6376 shows this in Appendix A.3. Which domain signed is stated in the d= tag of the signature.

Can I change the key? Yes, that is what the selector is for. RFC 6376 advises signing with the new key immediately after a change and keeping the old public key in the DNS for a reasonable time, so that messages verified late still pass (Section 5.2).

Matching tool