DKIM

The sending system hashes a chosen set of headers and the body, signs the hash with its private key, and adds the result as a `DKIM-Signature` header.

That header names the domain and a selector — a short label — which together form the DNS name where the public key lives: `<selector>._domainkey.<domain>`.

A receiving server reads the header, looks up that TXT record, and verifies the signature against it.

Selectors exist so a domain can have several keys at once: one per sending service, and a new one alongside the old during a rotation.

The headers listed in the signature's own `h=` tag, typically `From`, `Subject`, `Date` and a few others. Headers not listed are unsigned and can be altered without breaking anything.

The body, or a stated prefix of it when a length tag is used — a feature best avoided, since it allows content to be appended after the signed portion.

The `From` header is always signed in practice, because DMARC alignment depends on it.

Envelope information is not covered. DKIM authenticates the message, SPF authenticates the connection, and they are checking different things.

Mailing lists that add a subject prefix or a footer modify signed content, which invalidates the signature. This is the original reason mailing lists and strict DMARC policies interact badly.

Forwarding that rewrites headers does the same, though plain forwarding without modification preserves the signature — which is DKIM's main advantage over SPF.

Gateways that convert or re-encode the message body, including some antivirus and archiving systems inside the recipient's own organisation.

Key rotation done in the wrong order: removing the old DNS record before messages signed with the old key have finished being delivered.

You need the selector, which is not discoverable from DNS. It appears in the `DKIM-Signature` header of any message the domain has sent, under the `s=` tag.

`dig <selector>._domainkey.example.com TXT +short` then returns the published key.

Send a message to an account you control and read the full headers. The `Authentication-Results` header added by the receiving server reports whether DKIM passed, and against which domain.

Check every service that sends on your behalf — transactional mail, marketing platforms, ticketing systems — since each usually needs its own selector.