DKIM works like a wax seal. When your server sends a message, it signs selected parts of it with a private key. The matching public key sits in your DNS. The receiver fetches the key, checks the signature and learns two things: the message came from a server that holds your key, and it was not tampered with in transit.
What gets published
The public key lives in a TXT record at selector._domainkey.yourdomain.com. The selector lets one domain have several keys at once, for different services or for rotation.
Inside the message, a DKIM-Signature header names the signing domain (d=) and the selector (s=).
DKIM in Amazon SES
SES offers two ways.
- Easy DKIM is the default. SES adds a 2048-bit DKIM key to every message from the identity and gives you three CNAME records to publish. Once DNS has them, SES signs your mail for you, and your records point at keys AWS manages.
- BYODKIM (bring your own DKIM) lets you generate the key pair yourself and give SES the private key. The key must be between 1024 and 2048 bits.
Either way, the signing domain should match your From domain, so the signature counts for DMARC alignment. With Easy DKIM on your own domain it does.
Why it matters more than SPF
DKIM survives forwarding, which SPF does not, because the signature travels with the message. For senders on SES it is usually the leg that carries DMARC. If it breaks, DMARC often breaks with it.
Common failures
- The CNAME records were never added, or were added at the wrong host name.
- A DNS clean-up deleted the
_domainkeyrecords. - A DNS provider that adds the domain name twice to the record.
Common questions
Does DKIM encrypt my email?
No. It signs the message, which proves where it came from and that it was not changed. The content is not hidden.
What happens if my DKIM record is deleted?
New messages fail the DKIM check. If DMARC relies on DKIM, as it usually does with SES, those messages can fail DMARC too and be filtered or rejected.