What does DKIM do?
DKIM is a process to validate sending domain names associated to email messages through cryptographic authentication. It achieves this by inserting a digital signature into the message header which is later verified by the receiving host to validate the authenticity of the sending domain.
What to consider before creating the DKIM record?
Step 1: Determine which domains are allowed to send outbound mail on its behalf.
Step 2: Create the DKIM public/private keys and the policy record. The ‘public’ key will be used in your public-facing DNS TXT record along with what’s called a policy record.

The ‘private’ key will be used on your sending MTA. When an outbound message is sent from the sending MTA, it will add the private key to the message header for identification and validation by the receiving domain by way of the public key. This uses a new domain name identifier to digitally sign the message.

Some online wizards that you can use to assist with the public/private key generation and policy record creation for DKIM. Just specify your domain name and the selector being used.
http://www.socketlabs.com/services/dkwiz

Step 3:Create TXT records using the DKIM information created from these wizards. Be sure to include DKIM records for all of your applicable sending domains. These records will be included in your public facing DNS record for each sending domain. There are basically two types of DNS records used by Domain Keys; policy records and public key records.

Policy records:
A domain name using Domain Keys should have a single policy record configured.
This is a DNS TXT-record with the name "_domainkey" prefixed to the domain name - for example "_domainkey.example.com". The data of this TXT-record contains the policy which is basically either "o=-" or "o=~". "o=-" means "all e-mails from this domain are signed", and "o=~" means "some e-mails from this domain are signed". Additional fields for test (t), responsible e-mail address (r), and notes (n) may also be included - for example "o=-;

Step 4:Be sure that your existing sending MTA’s support DKIM. If not, upgrade them them so that they will have DKIM support. The sending MTA’s are your last touch systems of outbound mail flow and this is where DKIM signatures will attached to the outbound messages. An agent in the message transit path can sign the message content and selected header fields. The signature information is placed into a field of the RFC2822 message header.

DKIM defines an authentication mechanism for email, using:
A domain name identifier
Public-key cryptography
A DNS-based public key publishing service.

Article ID: 117, Created: February 21, 2020 at 8:35 PM, Modified: February 21, 2020 at 8:35 PM

What Is DKIM Record And How To Create It?

Add Feedback

Was this article helpful?

Share this article