GLOSSARY

What is DKIM?

DKIM cryptographically signs your outgoing email so receivers can verify it was not altered and really came from your domain. Learn how it works.

Open the DNS lookup →All free tools

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to your outgoing email. Receiving servers verify that signature against a public key you publish in DNS, proving the message really came from your domain and was not tampered with in transit.

How the signature works

Your mail server signs each message with a private key. The matching public key lives in a DNS TXT record at a "selector" subdomain. The receiver reads the DKIM-Signature header, fetches your public key from DNS, and checks the signature — a match proves authenticity and integrity, using the same HMAC/public-key ideas as other signing.

DKIM with SPF and DMARC

DKIM complements SPF (which authorizes sending IPs) and DMARC (which sets policy when checks fail). Together they are the standard defense against spoofing and are increasingly required for good deliverability. A DNS lookup shows your DKIM TXT record.

Try it now — free, no signup

Use the DNS lookup in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.

Open the DNS lookup →Sign up for the full API

FAQ

Where is the DKIM key stored?›
The public key is a TXT record under a selector subdomain like selector._domainkey.yourdomain.com.
Do I need DKIM if I have SPF?›
Yes — they protect different things. SPF authorizes IPs; DKIM proves the message was not altered and came from you. DMARC ties them together.

Related

What is an SPF record?An SPF record lists which servers may send email for your domain, fighting spoofing. Learn how SPF works and look yours up free.What is a TXT record?A TXT record holds arbitrary text in DNS, used for domain verification and email policies like SPF and DKIM. Learn how and look one up free.What is HMAC?HMAC proves a message was not tampered with and came from someone who holds a shared secret. Learn how it works — it powers TOTP and JWT signing.