What Is DKIM?

The signing domain and selector

Two details matter when investigating a signature: the signing domain and the selector. They help identify the public key the receiver should use. Looking only at the visible From domain can send the investigation to the wrong record.

RFC 6376 describes DKIM's signing and verification model. Its cryptographic guidance has updates, including RFC 8301. For a real deployment, follow the sending provider's current supported configuration rather than copying an old selector or key example from a guide.

The provider operating the signing system and the person controlling DNS may be different owners. Agree who changes each side and how a real message will be checked afterwards. A published record is only one part of the evidence.

An example of finding the right key

Suppose an illustrative signature contains d=example.com and s=selector1. Those values identify the signing domain and selector to investigate. They are explanatory examples using a reserved domain, not values for a live setup.

If a teammate checks a different selector and finds no key, that result does not yet explain the signature in the message. Start with the values actually present, then preserve the receiver's reported authentication result and the message's timestamp.

This also helps during key changes. A later lookup shows the currently published state, which may differ from what a receiving system saw earlier. Keep the timing and original evidence instead of assuming a current green result reconstructs the incident.

A DKIM pass and DMARC alignment are different questions

The signing identity can differ from the address displayed to the reader. DMARC uses alignment rules to connect an authenticated identity with that visible domain. A DKIM pass alone should therefore be read alongside the DMARC result, not used as a substitute for it.

Avoid describing DKIM as blanket proof that a message is trustworthy. Signature verification answers a technical question about a signer and covered content. The business still needs to assess the message, its sender and its purpose.

What to check next

Save a received message, locate the signing domain and selector, and ask the signing provider which configuration applies. Compare the actual authentication result with the published key information before changing either side.

Use the DKIM checker for the record question and the DKIM versus DMARC guide to separate signature problems from alignment problems. Naming the right owner is often the most useful first step in getting the issue resolved.