🔑

DKIM Checker

DomainKeys Identified Mail (DKIM) adds a digital signature to emails, allowing the receiver to verify that the email was indeed authorized by the owner of that domain.

RFC: RFC 6376
KEY TYPE: RSA/Ed25519
HASH: SHA-256

What is DKIM Checker?

DKIM provides a way to validate a domain name identity that is associated with a message through cryptographic authentication.

How it Works

The sending server signs the email with a private key. The public key is published in DNS. The receiving server uses the public key to verify the signature. If the message was altered in transit, the signature will be invalid.

Key Use Cases

Ensuring message integrity (preventing tampering).

Building domain reputation with ISPs.

Achieving DMARC alignment.

Advanced Details

DKIM selectors allow a domain to have multiple DKIM keys for different services (e.g., marketing mail vs. corporate mail).

Cybersecurity Pros & Cons

Security Advantages
  • Cryptographic signature detects any in-transit message tampering, protecting against content injection attacks.
  • DKIM keys can be rotated per sending service (selector-based), limiting blast radius of a single key compromise.
  • DKIM signatures survive email forwarding — unlike SPF, they remain valid even when the relay IP changes.
  • Strong DKIM keys (2048-bit RSA or Ed25519) are computationally infeasible to forge without the private key.
Security Limitations
  • A compromised DKIM private key allows an attacker to send fully authenticated emails indistinguishable from legitimate ones.
  • DKIM only signs specific headers and body — a carefully crafted attack can inject unsigned content below the signed section.
  • Short DKIM keys (512/768-bit) have been publicly factored — weak legacy keys provide near-zero security.
  • DKIM does not verify the visible "From" address — only DMARC alignment bridges DKIM to the user-visible sender.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs