{"id":4123,"date":"2019-10-30T10:02:24","date_gmt":"2019-10-30T10:02:24","guid":{"rendered":"https:\/\/www.20i.com\/blog\/?p=4123"},"modified":"2025-12-10T10:55:41","modified_gmt":"2025-12-10T10:55:41","slug":"dkim-demystified","status":"publish","type":"post","link":"https:\/\/www.20i.com\/blog\/dkim-demystified\/","title":{"rendered":"DKIM demystified"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>DomainKeys Identified Mail (DKIM) allows a person or organisation to claim responsibility for an email message by associating a domain name with the message. <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The purpose of DKIM is to authenticate that the content of any DKIM-signed email message is not modified during the transfer between sender&#8217;s or ISP (Internet Service Provider) and receiver&#8217;s mail servers. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DKIM signatures are produced using a private key by the sender&#8217;s mail server. They&#8217;re then verified by the receiver&#8217;s mail server by fetching public key via DNS query (illustrated below).<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_public_private.png.webp\"><img loading=\"lazy\" decoding=\"async\" width=\"601\" height=\"665\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_public_private.png.webp\" alt=\"DKIM public and private key exchanges\" class=\"wp-image-4131\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_public_private.png.webp 601w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_public_private-271x300.png.webp 271w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_public_private-370x409.png.webp 370w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_public_private-270x299.png.webp 270w\" sizes=\"auto, (max-width: 601px) 100vw, 601px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Why use DKIM for your domain(s)?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are two major reasons to use DKIM for your domain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>make it harder for spammers to spoof your domain and using it for sending malicious spam or phishing campaigns<\/li>\n\n\n\n<li>build a reputation for your domain over time with major ISPs and ESPs (Email Service providers)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s important to understand what DKIM does and what it doesn&#8217;t. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using DKIM will make sure your message hasn&#8217;t been changed during the transfer, but it doesn&#8217;t encrypt or change the contents of your message in any way. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many ESPs use TLS (Transport Layer Security) encryption to encrypt messages as they move between sender and recipients, but it&#8217;s still possible to send unencrypted messages if an email server refuses a TLS handshake. Once a message has been delivered, the DKIM signature will remain in the email (SMTP) headers. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The approach taken by DKIM differs from previous approaches to message signing (e.g., Secure\/Multipurpose Internet Mail Extensions (S\/MIME) [RFC5751], OpenPGP [RFC4880]) in that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>the message signature is written as a message header field so that neither human recipients nor existing MUA (Mail User Agent) software is confused by signature-related content appearing in the message body<\/li>\n\n\n\n<li>there is no dependency on public- and private-key pairs being issued by well-known, trusted certificate authorities<\/li>\n\n\n\n<li>there is no dependency on the deployment of any new internet protocols or services for public-key distribution or revocation<\/li>\n\n\n\n<li>signature verification failure does not force rejection of the message<\/li>\n\n\n\n<li>no attempt is made to include encryption as part of the mechanism<\/li>\n\n\n\n<li>message archiving is not a design goal<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">DKIM:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>is compatible with the existing email infrastructure and transparent to the fullest extent possible<\/li>\n\n\n\n<li>requires minimal new infrastructure<\/li>\n\n\n\n<li>can be implemented independently of clients in order to reduce deployment time<\/li>\n\n\n\n<li>can be deployed incrementally; and<\/li>\n\n\n\n<li>allows delegation of signing to third parties<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How DKIM works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s an illustration explaining the process:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_explained.png.webp\"><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"1017\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_explained.png.webp\" alt=\"DKIM explained diagram\" class=\"wp-image-4151\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_explained.png.webp 600w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_explained-177x300.png.webp 177w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_explained-370x627.png.webp 370w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/dkim_explained-270x458.png.webp 270w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">DKIM uses a two-phase process, as follows:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">1.<strong>Signing Phase<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li> takes place on sender&#8217;s mail server<\/li>\n\n\n\n<li>contains digital signatures of headers and body of the message<\/li>\n\n\n\n<li>requires the private key for the authorised domain for signing<\/li>\n\n\n\n<li>and adds the DKIM signature as a special email header.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"> 2.<strong>Verifying phase<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>takes place on receiver&#8217;s mail server<\/li>\n\n\n\n<li>fetches public key for sender&#8217;s domain from DNS record<\/li>\n\n\n\n<li>extracts the DKIM signature from the email headers<\/li>\n\n\n\n<li>validates the signature using the domain&#8217;s public DomainKeys <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s important to note that failing DKIM signature validation doesn&#8217;t mean that the email message will be blocked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Examining the DKIM code<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s have a deeper look at the process. If you&#8217;re only interested in the basic setup in <a href=\"https:\/\/www.20i.com\/my20i\">My20i<\/a>, you can skip this section!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each email message is signed with your private key (stored securely on our mail servers). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We create hashes (encoded message digests) of both message headers and body, and then use your private key to sign the hashes. The signature itself contains everything a recipient server needs to validate the signature. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A DKIM signature header might look like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DKIM-Signature: v=1; a=rsa-sha256; q=dns\/txt; c=relaxed\/relaxed;\n d=20iisawesome.co.uk; s=s1; h=Message-ID:Subject:To:From:Date:Content-Type:\n MIME-Version:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:\n Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc\n :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:\n List-Subscribe:List-Post:List-Owner:List-Archive;\n bh=3zHAZOM3ZC2Xnw6cIsUoqMayPLB+3ctDAb0TU\/ZVneE=; i=@20iisawesome.co.uk;\n t=1572341960; x=1572428360;\n b=WkWIVcElG0eCkeAXG+eT6Tq+eAZgOvg9PL422L82\/ETTsJd\n hnywMKnzKiVckU4d2OfKjEFhK4ctoPhubXv72iDSwJPatCRSutCFjgO4q0G\/fO1YDCuOnnWlcZZxs\n gcVBXWIOQfVlvRFTDDyy+HMk2YdgG6SX+2O\/GOGoZTdBaWZ\/cs3GnNLUXu1hDmRukl0YEWbX6uvad\n G1kxBkLUQodeaqhxo9\/Bt+GI1\/LNqoPgaPM2R4K53uztI\/GM9TZlfGjB31tBuAvsNEjuJyQgwh68p\n ZIQrU3eByl0ocdoiOIduxWn9aTTIbtNs19EwBsN2KfV3XbDW205p5Pun2FBzuVhA==;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To break this down:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DKIM-Signature:<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= Header name.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>v=1;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= Version of DKIM protocol used.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>a=rsa-sha256;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= Hashing (message digest) algorithm used to generate the hashes.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>q=dns\/txt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= Query type used to fetch the public key.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>c=relaxed\/relaxed;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= Canonicalisation of algorithm for headers and body. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This last element is there because some mail systems modify email messages in transit, potentially invalidating a signature. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most Signers, mild modification of an email is immaterial to validation of the DKIM domain name&#8217;s use. The &#8220;simple&#8221; header canonicalization algorithm does not change header fields in any way. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are two canonicalized algorithms. <code>simple<\/code> doesn\u2019t allow any changes, and <code>relaxed<\/code> allows common changes to whitespace and header line wrapping. Canonicalization in the header and body can be managed individually, and uses a header\/body format.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>d=20iisawesome.co.uk;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= The email domain which signs the message. It&#8217;s used to build the domain reputation regardless of the Email Service Provider you use.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>s=s1;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= The Key Selector. It&#8217;s used as a unique identifier for the public key. As the domain could have more than one DKIM key, the selector is used to fetch the necessary public key for validation to happen.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>h=Message-ID:Subject:To:From:Date:Content-Type:MIME-Version:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= &nbsp;A colon-separated list of header field names that identify the header fields presented to the signing algorithm.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bh=3zHAZOM3ZC2Xnw6cIsUoqMayPLB+3ctDAb0TU\/ZVneE=;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= The hash of the canonicalized body part of the message before the message headers are signed.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>i=@20iisawesome.co.uk;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= Identity of the signer. This could be empty (any sender) or a particular email address (concrete sender). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This takes part in strict DKIM validation. If Strict DKIM is used then <em>any<\/em> DKIM-Signature header fields using the &#8220;i=&#8221; tag <em>must<\/em> have the same domain value on the right-hand side of the &#8220;@&#8221; in the &#8220;i=&#8221; tag and the value of the &#8220;d=&#8221; tag.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is, the &#8220;i=&#8221; domain <em>must not<\/em> be a subdomain of &#8220;d=&#8221;.  Use of Strict DKIM is recommended unless subdomaining is required.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>t=1572341960;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= The Signature Timestamp &#8211; the time that this signature was created. The format is the number of seconds since 00:00:00 on January 1, 1970 in the UTC time zone.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>x=1572428360;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= The Signature Expiration. Signatures <em>may<\/em> be considered invalid if the verification time at the Verifier is past the expiration date. Again, the format is the number of seconds since 00:00:00 on January 1, 1970 in the UTC time zone.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>b=WkWIVcElG0eCkeAXG+eT6Tq+eAZgOvg9PL422L82\/ETTsJd\n hnywMKnzKiVckU4d2OfKjEFhK4ctoPhubXv72iDSwJPatCRSutCFjgO4q0G\/fO1YDCuOnnWlcZZxs\n gcVBXWIOQfVlvRFTDDyy+HMk2YdgG6SX+2O\/GOGoZTdBaWZ\/cs3GnNLUXu1hDmRukl0YEWbX6uvad\n G1kxBkLUQodeaqhxo9\/Bt+GI1\/LNqoPgaPM2R4K53uztI\/GM9TZlfGjB31tBuAvsNEjuJyQgwh68p\n ZIQrU3eByl0ocdoiOIduxWn9aTTIbtNs19EwBsN2KfV3XbDW205p5Pun2FBzuVhA==;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">= The signature data of all the preceding information from the DKIM-Signature field.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The DNS record which contains the public key looks like: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>s1._domainkey.20iisawesome.co.uk IN TXT \"v=DKIM1;k=rsa;h=sha256;g=*;n=here-be-dragons;s=email;t=s;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAos7io0sGmoEEfpLGwwUGYj5YQpV5bsGsqi2XZx8y56W+NpHQDLS5nnyUftFBf3NaOMNzmKqycaLAviFSqtp7uztXuTj8lEr0KxwP6oDNIVojka+xzpMuXzUd4fXszGSJwsJbAd7CPDW1o4DVZlz3XRze\" \"1BJOpbRqF44+fv14XTHDUxrjl8jhjSKa02nXSdthWtRWHXzV8qwriFeaovb682O+2Ye6jGXRfsS3IPv0ybTmqgw\/uDEBBM2eJyfzkej8Xw3zOUqwvewVfQAcuLlmOML0+Rf6bfoirOoDYvPJUJYDVYVqWgOnCN7+m2lrWvIYOmq0uoLJrUJ3IQeqfnjMWwIDAQAB\"<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">How to set up DKIM with My20i<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"20i Email Hosting: Add a DKIM Record to your domain name and secure your emails\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/sr9uHnOTMcI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s fairly simple to implement DKIM with My20i:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Navigate to &#8216;DKIM Signatures&#8217; in the control panel, as shown below<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector.png.webp\"><img loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"290\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector.png.webp\" alt=\"My20i DKIM signatures\n\" class=\"wp-image-4134\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector.png.webp 800w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector-300x109.png.webp 300w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector-768x278.png.webp 768w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector-370x134.png.webp 370w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector-270x98.png.webp 270w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM-selector-740x268.png.webp 740w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/a><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Fill in the value of Selector for your new DKIM Signature; and<\/li>\n\n\n\n<li>Select &#8216;Add Signature&#8217; button <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">You can then start building your domain reputation right away.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"> Advanced features<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On the other hand, My20i provides fine-grained control over the DKIM signing process if it&#8217;s required by you. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To do this, you need to activate the advanced options by clicking on &#8216;Advanced Options&#8217; link, and you&#8217;ll see this:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"376\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures.png.webp\" alt=\"Add DKIM signatures\" class=\"wp-image-4136\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures.png.webp 800w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures-300x141.png.webp 300w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures-768x361.png.webp 768w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures-370x174.png.webp 370w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures-270x127.png.webp 270w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/DKIM_signatures-740x348.png.webp 740w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Here you can set up:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Granularity \/ Identity = Granularity of the key. <\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This value MUST match the Local-part of the &#8220;i=&#8221; tag of the DKIM-Signature header field (or its default value of the empty string if &#8220;i=&#8221; is not specified). Optional, default is &#8220;*&#8221;. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Note <\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Notes that might be of interest to a person. Optional, the default is empty.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service Type<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A colon-separated list of service types to which this record applies. Verifiers for a given service type <em>must<\/em> ignore this record if the appropriate type is not listed. Currently defined service types are as follows: <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">* &#8211; matches all service types<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">email &#8211; electronic mail (not necessarily limited to SMTP).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Again, this is optional, default is &#8220;*&#8221;.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Canonicalization<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Message canonicalization. This tag informs the verifier of the type of canonicalization used to prepare the message for signing. This is also optional, but the default is &#8220;relaxed&#8221;. You can find out more info on this <a href=\"http:\/\/dkim.org\/specs\/rfc4871-dkimbase.html#canonicalization\">dkim.org<\/a>. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Expiry Time<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Signature Expiration. Signatures may be considered invalid if the verification time at the verifier is past the expiration date. The recommended default is 86400 seconds (1 day).&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Flag<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Flags, represented as a colon-separated list of names. Optional, the default is empty. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The defined flags are as follows:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>y<\/strong> &#8211; This domain is testing DKIM. Verifiers <em>must not<\/em> treat messages from signers in testing mode differently from unsigned email, even should the signature fail to verify. Verifiers may wish to track testing mode results to assist the signer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<strong>s<\/strong> &#8211; Any DKIM-Signature header fields using the &#8220;i=&#8221; tag <em>must<\/em> have the same domain value on the right-hand side of the &#8220;@&#8221; in the &#8220;i=&#8221; tag and the value of the &#8220;d=&#8221; tag. That is, the &#8220;i=&#8221; domain <em>must not<\/em> be a subdomain of &#8220;d=&#8221;. Use of this flag is recommended unless subdomaining is required.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Strict DKIM<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Flag for signing policy. Use with caution: if you choose strict signing policy and there is any error when signing &#8211; the message will be deferred! Optional, default is not checked.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As you could have more than one DKIM key pair per domain &#8211; you have to choose which one will be used for signing.  This could be done with &#8216;Set Default&#8217; option:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"304\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/setting-the-default-dkim-key-pair-in-my20i.png.webp\" alt=\"Set default\" class=\"wp-image-4143\" srcset=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/setting-the-default-dkim-key-pair-in-my20i.png.webp 800w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/setting-the-default-dkim-key-pair-in-my20i-300x114.png.webp 300w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/setting-the-default-dkim-key-pair-in-my20i-768x292.png.webp 768w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/setting-the-default-dkim-key-pair-in-my20i-400x152.png.webp 400w, https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2019\/10\/setting-the-default-dkim-key-pair-in-my20i-150x57.png.webp 150w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">So, to be able to sign your outgoing email you have to set a DKIM signature both as Default and Enabled.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Why should I use DKIM signatures?<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><br>DKIM, or DomainKeys Identified Mail, is an important part of email security and spam protection. It provides a way to validate a domain name identity associated with a message through cryptographic authentication. Here are some reasons why you should use DKIM:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Authentication<\/strong>: DKIM allows the recipient to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. This is done using a digital signature linked to the domain name.<\/li>\n\n\n\n<li><strong>Phishing and spoofing protection<\/strong>: Because DKIM verifies that an email was actually sent from the domain it claims to be sent from, it&#8217;s much harder for phishers and spoofers to pretend to be sending from a different address. This helps protect users from malicious emails.<\/li>\n\n\n\n<li><strong>Improved deliverability<\/strong>: Many email service providers check for DKIM. If you don&#8217;t have it, your emails may end up in the spam folder or may not be delivered at all. Using DKIM can help ensure that your emails end up in your recipients&#8217; inboxes.<\/li>\n\n\n\n<li><strong>Reputation<\/strong>: If your domain is known to use DKIM, it&#8217;s less likely to be blacklisted or considered a source of spam. This can be beneficial for your brand&#8217;s reputation.<\/li>\n\n\n\n<li><strong>Non-repudiation<\/strong>: Because the DKIM signature is linked to the domain name, it provides a form of non-repudiation. This means the sender cannot reasonably deny having sent the email.<\/li>\n<\/ol>\n\n\n<div class='code-block code-block-8' style='margin: 8px 0; clear: both;'>\n<a href=\"https:\/\/www.20i.com\/managed-cloud-servers\" target=\"_blank\"><img decoding=\"async\" src=\"https:\/\/www.20i.com\/blog\/wp-content\/smush-webp\/2023\/06\/managed-cloud-hosting-600x100.png.webp\" loading=\"lazy\" alt=\"Managed Cloud Hosting\"><\/a><\/div>\n\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>When will my DKIM signature become active?<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DKIM signing will start right after you set your signature as Default and Enabled. There is no waiting time for signature to become active.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>How could I disable DKIM signing?<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just set your signature as &#8216;Disabled&#8217;. Your email messages will no longer be signed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Could I use more than one signature for signing? <\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">No, you have to use only one signature. The one which is set as &#8216;Default&#8217; is used for signing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>What is the key length for DKIM signatures?<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> We&#8217;re using 2048 bit RSA keys. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em> Could I use DKIM signatures with different DNS provider? <\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> Yes, you could. Just use DNS controls to obtain the DNS record value, as shown in the image above.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> &nbsp;<strong><em>Could I use my own key\/pair for DKIM signing? <\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We wouldn&#8217;t advise to do so, as the private key should be stored without the secret passphrase. But if you have valid reasons to do so &#8211; please contact our Support team for further instructions how to use your own key pair.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> &nbsp;<strong><em>How often DKIM keys should be rotated? <\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DKIM keys should be rotated at least twice per year. It will reduce the risk of being compromised. In My20i, to rotate your keys, go in to Email &gt; Domain Keys (DKIM) &gt; Options &gt; Rotate Keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Need to know more? Feel free to contact our Support team or add any questions\/comments below.<\/strong><\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-small-font-size wp-block-paragraph\">Top photo by Chunlea Ju on Unsplash.<\/p>\n\n\n\n<script type=\"application\/ld+json\">\n{\n  \"@context\": \"http:\/\/schema.org\",\n  \"@type\": \"Webpage\",\n  \"name\": \"Managed Hosting\",\n  \"url\": \"https:\/\/www.20i.com\/managed-hosting\",\n  \"@id\": \"https:\/\/www.20i.com\/managed-hosting#webpage\"\n \n}\n<\/script>\n<script type=\"application\/ld+json\">\n{\n  \"@context\": \"http:\/\/schema.org\",\n  \"@type\": \"WebPage\",\n  \"@id\": \"https:\/\/www.20i.com\/blog\/dkim-demystified\/#webpage\",\n  \"url\": \"https:\/\/www.20i.com\/blog\/dkim-demystified\/\",\n  \"inLanguage\": \"en-gb\",\n  \"name\": \"DKIM demystified\",\n  \"description\": \"DKIM is a way to secure your email, increasing deliverability and avoiding fraud. A 20i Senior Systems Administrator explains DKIM in depth.\",\n\"image\": \"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2019\/10\/dkim_explained.png\",\n  \"isPartOf\": {\n    \"@id\": \"https:\/\/www.20i.com\/managed-hosting#webpage\"\n  },\n  \"about\": [\n    {\n      \"@type\": \"Thing\",\n      \"name\": \"DKIM\",\n      \"sameAs\": \"https:\/\/en.wikipedia.org\/wiki\/DomainKeys_Identified_Mail\"\n    }\n  ],\n  \"mentions\": [\n    {\n      \"@type\": \"Thing\",\n      \"name\": \"authenticate\",\n      \"sameAs\": \"https:\/\/en.wikipedia.org\/wiki\/Email_authentication\"\n    },\n    {\n      \"@type\": \"Thing\",\n      \"name\": \"email\",\n      \"sameAs\": \"https:\/\/en.wikipedia.org\/wiki\/Email\"\n    },\n    {\n      \"@type\": \"Thing\",\n      \"name\": \"spammers\",\n      \"sameAs\": \"https:\/\/en.wikipedia.org\/wiki\/Email_spam\"\n    },\n    {\n      \"@type\": \"Thing\",\n      \"name\": \"TLS\",\n      \"sameAs\": \"https:\/\/en.wikipedia.org\/wiki\/Transport_Layer_Security\"\n    },\n    {\n      \"@type\": \"Thing\",\n      \"name\": \"public key\",\n      \"sameAs\": \"https:\/\/en.wikipedia.org\/wiki\/Public-key_cryptography\"\n    }\n  ]\n}\n<\/script>\n<script type=\"application\/ld+json\">\n{ \n\"@context\": \"http:\/\/schema.org\", \n\"@type\": \"FAQPage\", \"@id\": \"https:\/\/www.20i.com\/blog\/dkim-demystified\/#FAQ\",\n\"url\": \"https:\/\/www.20i.com\/blog\/dkim-demystified\/\", \n\"headline\": \"DKIM demystified\", \n\"isPartOf\":{\"@id\":\"https:\/\/www.20i.com\/blog\/dkim-demystified\/#webpage\"},\n\"inLanguage\":\"en-gb\",\n  \"mainEntity\":[ \n{\n    \"@type\": \"Question\",\n    \"name\": \"Why should I use DKIM signatures?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"<p>DKIM, or DomainKeys Identified Mail, is an important part of email security and spam protection. It provides a way to validate a domain name identity associated with a message through cryptographic authentication. Here are some reasons why you should use DKIM:<\/p>\n<ol>\n<li>Authentication: DKIM allows the recipient to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. This is done using a digital signature linked to the domain name. <\/li>\n<li>Phishing and spoofing protection: Because DKIM verifies that an email was actually sent from the domain it claims to be sent from, it\u2019s much harder for phishers and spoofers to pretend to be sending from a different address. This helps protect users from malicious emails. <\/li>\n<li>Improved deliverability: Many email service providers check for DKIM. If you don\u2019t have it, your emails may end up in the spam folder or may not be delivered at all. Using DKIM can help ensure that your emails end up in your recipients\u2019 inboxes. <\/li>\n<li>Reputation: If your domain is known to use DKIM, it\u2019s less likely to be blacklisted or considered a source of spam. This can be beneficial for your brand\u2019s reputation. <\/li>\n<li>Non-repudiation: Because the DKIM signature is linked to the domain name, it provides a form of non-repudiation. This means the sender cannot reasonably deny having sent the email. <\/li><\/ol>\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"What\u2019s the difference between .com and .co.uk?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"The difference mainly comes down to geography. A .com domain flags up a website as being either based in the US or operating as a global player. Most American companies use .com as their TLD, as the local .us extension has never really taken off across the pond. Firms that trade internationally choose it for obvious reasons: it\u2019s generic and stands for \u2018company\u2019.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"When will my DKIM signature become active?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"DKIM signing will start right after you set your signature as Default and Enabled. There is no waiting time for signature to become active.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"How could I disable DKIM signing?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"Just set your signature as \u2018Disabled\u2019. Your email messages will no longer be signed.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"Could I use more than one signature for signing?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"No, you have to use only one signature. The one which is set as \u2018Default\u2019 is used for signing.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"What is the key length for DKIM signatures?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"We\u2019re using 2048 bit RSA keys.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"Could I use DKIM signatures with different DNS provider?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"Yes, you could. Just use DNS controls to obtain the DNS record value, as shown in the image above.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \"Could I use my own key\/pair for DKIM signing?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"We wouldn\u2019t advise to do so, as the private key should be stored without the secret passphrase. But if you have valid reasons to do so \u2013 please contact our Support team for further instructions how to use your own key pair.\"\n    }\n  },\n{\n    \"@type\": \"Question\",\n    \"name\": \" How often DKIM keys should be rotated?\",\n    \"acceptedAnswer\": {\n      \"@type\": \"Answer\",\n      \"text\": \"DKIM keys should be rotated at least twice per year. It will reduce the risk of being compromised. In My20i, to rotate your keys, go in to Email > Domain Keys (DKIM) > Options > Rotate Keys.\"\n    }\n  }\n] \n}\n<\/script>\n","protected":false},"excerpt":{"rendered":"DomainKeys Identified Mail (DKIM) allows a person or organisation to claim responsibility for an email message by associating&hellip;","protected":false},"author":10,"featured_media":5956,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[51,47],"tags":[83,70],"class_list":["post-4123","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","category-web-hosting","tag-email","tag-web-hosting","cs-entry"],"_links":{"self":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/4123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/comments?post=4123"}],"version-history":[{"count":46,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/4123\/revisions"}],"predecessor-version":[{"id":14016,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/4123\/revisions\/14016"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/media\/5956"}],"wp:attachment":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/media?parent=4123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/categories?post=4123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/tags?post=4123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}