DKIM.

An email authentication standard defined in RFC 6376 that lets a sending domain add a cryptographic signature to outgoing messages so receivers can verify that headers and body were not altered. It belongs to the Network Security category of cybersecurity.

An email authentication standard defined in RFC 6376 that lets a sending domain add a cryptographic signature to outgoing messages so receivers can verify that headers and body were not altered.

DomainKeys Identified Mail (DKIM) is specified in RFC 6376. The sending Mail Transfer Agent generates an RSA or Ed25519 signature over selected headers (typically From, Subject, Date) and the body, then adds a DKIM-Signature header that names the signing domain (d=) and the selector (s=). Receivers fetch the public key from selector._domainkey.d.example.com (TXT) and validate the signature. DKIM survives most forwarding scenarios and provides the cryptographic identifier DMARC aligns against. Key hygiene matters: use 2048-bit RSA or Ed25519, rotate selectors, retire old keys, and protect private keys with HSMs or KMS, since exposed keys allow attackers to forge mail.

Defences for DKIM typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: DomainKeys Identified Mail.