DKIM and DMARC

SPF checks who sent the mail. DKIM checks that the mail wasn’t changed on the way. DMARC ties both to the address the reader sees. Let’s take them one at a time.

DKIM: a signature in DNS

The sending service holds a private key. It signs selected headers and the body, and adds a DKIM-Signature header to the message. The public key lives in DNS.

Two values in that header tell the receiver where to look. d= is the signing domain. s= is the selector, a label that picks one key among many. The receiver combines them into a TXT lookup:

dig TXT mailer._domainkey.example.com +short

Here the selector is mailer and the domain is example.com. The record holds the public key.

Selectors are what make key rotation painless. Publish the new key under a new selector, switch the sender to it, and keep the old key online until messages signed with it have stopped arriving. Remove a key on purpose, never by accident.

A valid DKIM signature proves the signed parts arrived as sent, under that signing domain. It doesn’t encrypt anything, doesn’t prove who the human sender is, and doesn’t mean the content is safe.

DMARC: alignment with the From header

Here’s the gap SPF and DKIM leave open. Both can pass for a domain that has nothing to do with the From: address the reader sees. A spammer can pass SPF for their own domain while showing yours.

DMARC closes it. A message passes DMARC when at least one of these holds:

• SPF passes, and the domain it checked aligns with the visible From: domain
• DKIM passes, and its d= domain aligns with the visible From: domain

So a transactional provider signing with its own domain passes DKIM but fails DMARC for you, until you set up DKIM under your own domain.

Roll out a policy carefully

A DMARC policy is a TXT record at _dmarc:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

p=none means “don’t block anything, just send me reports”. Start here. Read the aggregate reports that land at the rua address. Find every legitimate sender, fix their alignment, then move to p=quarantine and later p=reject.

Test real mail flows before tightening. Mailing lists and forwarders modify messages, and that can break one method or the other.

Two notes. The reporting mailbox receives operational data about your mail, so protect it. And DMARC is a request to receivers, not a command. Each one makes its own delivery decision.

Try this: open a message you received and look at its Authentication-Results header. Note the SPF domain, the DKIM d= and s=, the visible From: domain, and whether they align. Then check your own DMARC record with the email DNS tool.