DKIM and Cryptographic Signing

Why it matters: DKIM survives forwarding better than SPF and is often what makes DMARC pass. Knowing how to read a signature header makes email troubleshooting concrete.

By the end you can:

• Explain signing and verification
• Read d= and s= from a header
• Locate a selector's DNS record
• Describe key handling and rotation basics

Learn (15 min)

1. Sign and verify (5 min)

The sending system signs selected headers and body with a private key. The receiver reads the signature, finds the public key in DNS, and verifies it. A valid signature shows the signed content wasn't altered in a way that breaks it and that the signing domain controlled the key. It does not prove the message is safe.

DKIM-Signature: v=1; a=rsa-sha256; d=example.org; s=sel1;
  h=from:to:subject:date; bh=...; b=...

2. Selectors and DNS (5 min)

s= is the selector; d= is the signing domain. The key lives at:

<selector>._domainkey.<domain>
sel1._domainkey.example.org

Providers give you the exact TXT or CNAME to publish (Microsoft 365, for example, typically uses CNAME records for two selectors so it can rotate keys). Use the values generated for your tenant; values from someone else won't work.

dig +short CNAME sel1._domainkey.example.org
dig +short TXT   sel1._domainkey.example.org

3. Protect keys and check alignment (5 min)

The private key stays with the mail service or a secure key store. The public key belongs in DNS. Rotate through the provider's documented process. For DMARC, DKIM helps only if the signing domain (d=) aligns with the visible From domain.

Apply (15 min)

Worked example (3 min). Header shows d=mailer.newsletter-vendor.example; s=campaign2026 and From: news@example.org. DKIM may pass, but d= is the vendor's domain, so under DMARC it isn't aligned with example.org. Fix: configure the vendor's custom-domain authentication so it signs with d=example.org (usually by publishing the vendor's provided CNAMEs).

Lab (7 min): Read headers.

1. Send yourself an email from a service you use; open "show original/headers."
2. Find DKIM-Signature, note d= and s=, then find the Authentication-Results lines for dkim, spf, and dmarc.
3. Query the DNS record for that selector.
4. Decide whether the signature is aligned with the visible From domain.

Deliverable: A header annotation (fields + DNS lookup result + alignment decision). You're done when: You can state why alignment passes or fails.

Check yourself (5 min)

1. Which key signs? Which does the receiver fetch?
2. What does the selector identify?
3. Does a valid DKIM signature prove a message is safe?
4. Scenario: DKIM passes but DMARC fails. What do you compare?
5. Why shouldn't you ever publish a private key?

Reference

Common mistakes

Cheat sheet: header d= + s= → query <s>._domainkey.<d> → verify pass → compare d= with visible From.

Key terms: DKIM, selector, signing domain, public/private key, alignment.

Interview prompts: How does key rotation work with selectors?

Go deeper: DKIM, RFC 6376 · Microsoft: Configure DKIM

Next: Lesson 44 — DMARC.