DKIM Implementation Guide

DomainKeys Identified Mail (DKIM) is an email authentication method that uses public-key cryptography to sign outgoing messages. Every email sent from your domain gets a digital signature added to its headers. The receiving mail server retrieves your public key from DNS and uses it to verify the signature. DKIM proves two things: 1. The email genuinely originated from your domain (authenticity) 2. The message content was not modified in transit (integrity) Unlike SPF, which only checks the sending server's IP address, DKIM verifies the message itself. This makes DKIM essential for forwarded emails, which often fail SPF checks because the forwarding server's IP isn't in the original domain's SPF record. Cyber Defense Agent checks for DKIM configuration as part of every scan. A domain without DKIM signing is missing a critical layer of email authentication.

DKIM implementation involves generating a key pair and publishing the public key in DNS: 1. Generate DKIM keys — Most email providers handle this automatically. In Microsoft 365, go to Defender > Email & collaboration > Policies > DKIM. In Google Workspace, go to Admin > Apps > Google Workspace > Gmail > Authenticate email. 2. Publish the public key — Your provider will give you a CNAME or TXT record to add to your DNS. The record is published under a selector subdomain: selector1._domainkey.yourdomain.com. 3. Enable DKIM signing — Activate DKIM signing in your email provider's admin console. All outgoing emails will now include a DKIM-Signature header. 4. Verify — Send a test email to an external address and check the headers for "dkim=pass" in the Authentication-Results header. Run a Cyber Defense Agent scan to confirm. For third-party services (marketing platforms, CRM), each service needs its own DKIM configuration. Check each provider's documentation for their specific DKIM setup process.

DKIM keys should be rotated periodically to maintain security: Why rotate keys: - Limits exposure if a private key is compromised - Longer keys (2048-bit) provide stronger security than older 1024-bit keys - Some compliance frameworks recommend annual key rotation Rotation process: 1. Generate a new key pair with a new selector (e.g., selector2) 2. Publish the new public key in DNS under the new selector 3. Wait for DNS propagation (24-48 hours) 4. Switch your email provider to sign with the new selector 5. Keep the old public key in DNS for 7-14 days (to verify emails in transit) 6. Remove the old public key after the transition period Best practices: - Use 2048-bit keys minimum (1024-bit is increasingly vulnerable) - Rotate keys at least annually - Document your current selectors and rotation schedule - Test thoroughly before removing old keys