What key length should a DKIM record use?

A 2048-bit RSA key is the current default. 1024-bit keys still verify but are considered weak, and some providers have started treating them as unsigned, so a domain still publishing one is worth rotating.

Does DKIM encrypt the email?

No. DKIM signs the message, it does not encrypt it. Anyone can read a DKIM-signed email in transit; the signature only proves who sent it and that the content was not changed. Encryption in transit is handled separately by TLS.

JaxSuite AI

What Is DKIM?

TL;DR

DKIM, or DomainKeys Identified Mail, is a standard that adds a cryptographic signature to outgoing email. The receiving server verifies the signature against a public key in the sending domain DNS, which proves the message came from that domain and was not altered in transit.

How does DKIM verification work?

The sending server signs selected headers and the message body with a private key and attaches the result as a DKIM-Signature header. The receiving server reads the domain and selector from that header, fetches the matching public key from DNS, and recomputes the signature.

A match proves two things at once: the message was signed by someone holding the private key for that domain, and nothing covered by the signature changed on the way. A mismatch usually means the message was modified in transit rather than that it was forged.

What is a DKIM selector?

A selector is a label that lets one domain publish several keys. The public key lives at selector._domainkey.yourdomain.com, so a provider using the selector google publishes at google._domainkey.yourdomain.com.

Selectors are what make key rotation possible without downtime. A new key is published under a new selector, sending switches to it, and the old selector is removed once no signed mail is still in flight.

Why does DKIM matter more than SPF for forwarded mail?

Forwarding changes the sending server, which breaks SPF because the new server is not in the original record. A DKIM signature survives forwarding as long as the forwarder does not alter the signed headers or body, so it is often the only check that still passes.

That is the practical reason to publish both. DMARC accepts either an SPF pass or a DKIM pass, provided the passing domain aligns with the From address, so DKIM keeps legitimate forwarded mail from failing policy.

FAQ

Frequently asked questions

A 2048-bit RSA key is the current default. 1024-bit keys still verify but are considered weak, and some providers have started treating them as unsigned, so a domain still publishing one is worth rotating.