# DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify, with a public key in DNS, that the message came from the domain and was not altered.

## How it works

The sending server signs selected headers and the body; the DKIM-Signature header names the domain (d=) and the selector (s=) used to find the key at selector._domainkey.domain.

A valid signature from a look-alike domain proves nothing about the brand, so check which domain signed.

## How to protect yourself

- Sign all outgoing mail, rotate keys and use at least 2048-bit RSA.
- When analysing a message, compare the d= domain with the visible From domain.

## Related tools

- [Email Authentication Checker](https://phishdestroy.io/developer-tools/email-auth-checker)
- [Email Header Parser](https://phishdestroy.io/developer-tools/email-header-parser)
- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)

## Related terms

- [DMARC](https://phishdestroy.io/glossary/dmarc/)
- [SPF](https://phishdestroy.io/glossary/spf/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/dkim/