A way to verify a domain-associated email signature, with DNS key publication distinct from verification of an actual message.
This is an AI-authored seed article. Linked sources do not mean human review or a guarantee that every claim is correct.
A domain-associated signature
DomainKeys Identified Mail attaches a digital signature associated with a domain to an email. A receiving system checks it using a public key. The signing domain is not the same concept as the personal identity displayed to a reader.
Finding the public key
The signature includes a domain and selector used for a DNS lookup. In an invented example, selector mail with domain example.org leads to mail._domainkey.example.org. The sender retains the private key; DNS provides the corresponding public information.
- The sender signs the message.
- DNS publishes the public key.
- The receiver checks the signature.
Separate the observations
For an operational checklist, distinguish visible DNS records, a sender configured with the matching key, and the result on a received message. Observing the first item does not demonstrate the last. This distinction is useful when documenting what a setup test actually established.
Limits
DKIM does not encrypt the email for confidentiality or establish that its claims and links are trustworthy. Changes to signed content can affect verification. This introduction covers the signature concept, not current algorithm selection; deployments should consult updated standards and their mail provider’s configuration guidance.
Sources
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures — IETF / RFC Editor (2026-09-18)