Email and DNS security
DKIM and DMARC
Verify signed mail, require alignment with the visible From domain, and roll out an enforcement policy without blocking legitimate senders.
8 minute lesson
DKIM signs selected message content. The receiving server gets the public key from a DNS record beneath a selector such as mailer._domainkey.example.com.
The sending service keeps the private key and adds a DKIM-Signature header. Its d= value names the signing domain and s= names the selector. The receiver combines them to query the public key:
dig TXT mailer._domainkey.example.com +shortSelectors let you rotate keys or give separate services separate keys. Publish the new key before sending with it, retain the old key while messages signed with it can still arrive, and remove compromised or retired keys deliberately.
A valid DKIM signature proves that the signed headers and body survived verification under that signing domain. It does not encrypt the message, prove the human sender’s identity, or say the content is trustworthy.
DMARC connects authentication to the domain visible in the From: header. A message passes DMARC when at least one of these is true:
- SPF passes and its authenticated domain aligns with the visible From domain
- DKIM passes and its
d=domain aligns with the visible From domain
This alignment is why an unrelated provider domain can pass SPF or DKIM while DMARC still fails.
A monitoring policy looks like:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"p=none requests reports without asking receivers to quarantine or reject failures. Review aggregate reports, identify every legitimate sender, fix alignment, then move deliberately toward quarantine or reject. Forwarders and mailing lists can modify message paths or content, so test real mail flows instead of assuming one authentication method always survives.
Reporting addresses receive operational data and should be secured and monitored. DMARC policies are receiver requests, not a guarantee that every receiver makes the same delivery decision.
Your action is to inspect a delivered message’s authentication results and DNS. Identify the SPF domain, DKIM d= and s=, visible From domain, alignment result, and current DMARC policy. Use the email DNS tool to check the record structure.
Lesson completed