DKIM

• DKIM (Domain Keys Identified Mail) is a mechanism that authenticates all messages sent from a domain using asymmetric key cryptography.
  • DKIM uses two keys; a private key used for signing, and a public key for verification
  • The administrator publishes the public key to the DNS record
  • The sending server signs all out-bound messages by using the private key to generate a hash from the message headers and body.
  • Recipients verify the signed email against the public key
• The DKIM key is shared via a TXT record
  • DKIM records are differentiated with key selectors, and each email server requires its own public/private key pair.
    • You may have multiple DKIM records with different key selectors.
    • Because authentication occurs by key pair, tools like MxToolBox often require the selector to test and validate the correct key.
  • Can also be configured as a CNAME record^[1] which points to the actual DKIM TXT record.
    • CNAMEs are often used by service providers to allow them to manage and regularly cycle keys without bothering clients.
  • When rotating keys, you’d publish selector1._domainkey and selector2._domainkey simultaneously, switch signing to the new key, then remove the old record after clients have refreshed.
• Only servers with access to the private key are able to generate a valid signature, and proves the message was sent from an authorized sender.^[2]

DKIM Implementation: 3rd-Party Mail Provider

The process to configure DKIM is different for each email provider.

If your mail provider is also your DNS host, it's often as easy as checking a box. However, if your mail provider and DNS host are different, then you will be required to create specific DNS entries on the name server to authenticate. Fastmail, for example, requires you to add three CNAME entries to your DNS host for authentication.

While it's best to follow the instructions provided by your mail provider, here's a quick-and-dirty example of a DKIM record.

1. Name: mx01._domainkey
2. Type: TXT
3. TTL: 3600
4. Value: v=DKIM1; k=rsa; p=bG9sIHlvdSBhYnNvbHV0ZSBuZXJkLCB5b3UgZm91bmQgbWUhIEkgd2lzaCBJIGNvdWxkIGdpdmUgeW91IHNvbWV0aGluZywgYnV0IGFsYXM7IGhpdCBtZSB1cCBpZiB5b3Ugd2FudCB0byBjaGF0IQ==

Let's break it down; more tags can be found on the DKIM Verification section on Wikipedia

1. Name: mx01._domainkey
   1. mx01
      1. This is the selector used to identify the correct key
      2. In this case, it appears to be the public key for the "MX01" mail server. The "MX02" mail server might have the selector mx02.
   2. _domainkey
      1. This identifies the TXT record as a DKIM (Domain Key) entry
   3. Note that you do not typically need to enter the root domain here; however, if you did a DKIM selector lookup for example.com, you would see the entry as mx01._domainkey.example.com
2. Type: TXT
   1. This is a text record (as opposed to A, CNAME, etc.)
3. TTL: 3600
   1. The time to live is 1 hour (3600 seconds)
   2. This is an expiration date for the DKIM record, and helps DNS servers maintain up-to-date records.
4. Value: v=DKIM1; k=rsa; p=bG9sIHlvdSBhYnNvbHV0ZSBuZXJkLCB5b3UgZm91bmQgbWUhIEkgd2lzaCBJIGNvdWxkIGdpdmUgeW91IHNvbWV0aGluZywgYnV0IGFsYXM7IGhpdCBtZSB1cCBpZiB5b3Ugd2FudCB0byBjaGF0IQ==
   1. v=DKIM1
      1. Specifies the DKIM version; at this point, it's always DKIM1.
   2. ;
      1. The separator between values.
   3. k=rsa
      1. The key type specifies the kind of encryption used to create the key-pair.
      2. The default is RSA.
   4. p=bG9sIHl...
      1. The Base64-encoded public key.
      2. Most providers generate a 2048-bit key by default, and anything weaker (e.g., 1024 bits) is discouraged.

dig

Metadata

Sources

DomainKeys Identified Mail (DKIM)
DomainKeys Identified Mail - Wikipedia
RFC 6376 - DomainKeys Identified Mail (DKIM) Signatures

Tags

#defs_sec