07 Jun
Good email practices – what is DKIM?
DKIM (Domain Keys Identified Mail) is an authentication technique for incoming messages and additional security for your correspondence.
It uses public key cryptography solutions to detect malicious sources (so-called spam). By adding a header with a digital signature to the correspondence, the recipient can be sure that the sender of the message is indeed the owner of the domain and not someone impersonating him.
How does it work?
First, a key pair – private and public – is generated.
The sender of the message places the public key in a TXT record for generic DNS (Domain Name System) records, while the private key is contained in a digital signature added to a unique message header.
The header contains encrypted information about the generated signature and the message body.
A message encrypted in this way passes through the recipient’s mail server, where information from the sender’s DNS record is retrieved together with the public key. If the data are decrypted correctly, we receive a guarantee of receiving an authentic message from a trusted source (address owner).
DKIM, DMARC, SPF
All three standards are used for email authentication. They are complementary in their operation and, when used together, represent best practice for preventing email forgery.
- SPF (Sender Policy Framework) – defines the addresses in your organisation that can send messages. It also protects your domain from sending malicious content on your behalf.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) – unifies the operation of SPF and DKIM mechanisms into one common structure and allows domain owners to determine what happens to mail that negatively passes the verification process.
Do I need DKIM?
Setting up email authentication correctly is one of the most important steps you can take to improve security.
Regardless of the nature of your organisation or your email usage, implementing a form of mail authentication is a must and an increasingly required standard by mailbox providers. What’s more, a lack of the required DKIM signature can result in the rejection of even the most valuable content already at the server level.
How to configure DKIM on a domain by yourself?
Check if your mail server supports this function
Generate a key for your domain (remember to refresh the keys regularly for added security!)
Add your public key to DNS records
Include your signature in all messages, including DKIM signing
