Skip to main content

DKIM

An open drawer of index cards from a copyright card catalogue, resting on a wooden table

DomainKeys Identified Mail — cryptographic email signatures that prove a domain authorized the message; SES supports Easy DKIM and BYODKIM.

Platform & Operations. Last reviewed July 2026.

Ask an engineerAll terms

In this entry

The long reading room of Harvard’s Widener Library in 1920, rows of readers at lamplit tables

2serious gotchas

1regular gotcha

3tips

Definition

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outbound messages. Receivers look up the public key in DNS (selector._domainkey.example.com) and verify that headers/body were authorized by the signing domain. For DMARC, the DKIM signing domain must align with the visible From domain (organizational domain match under relaxed alignment).

When to use it

  • All Amazon SES production sending (Easy DKIM is the default path)
  • Multi-ESP setups where you bring your own key (BYODKIM) for consistent selectors across vendors
  • Bulk-sender compliance (Google, Yahoo, Microsoft) requiring authenticated, aligned mail

When not to use it

  • Signing with a third-party ESP domain that does not align to your From domain if you need DMARC pass
  • Rotating keys without dual-publishing DNS long enough for in-flight mail

Tips

  • Prefer 2048-bit keys where supported (SES Easy DKIM supports them)
  • Keep selector DNS CNAMEs (Easy DKIM) or TXT public keys (BYODKIM) under change control
  • Verify alignment on live messages via Authentication-Results headers, not console checkmarks alone

Gotchas

Serious

  • Body/header modifications by intermediate relays that break signatures
  • From domain marketing.brand.com signed as esp-mail.com without alignment → DMARC fail

Regular

  • Leaving old selectors published forever after rotation (harmless but noisy)

Related FactualMinds content

A printer’s case of metal type sorted into compartments, labelled Scotch Roman (Pica) Caps
Type in a sort case

More in Platform & Operations

Related services

Reading

Ask

Our AWS-certified team implements, audits and tunes DKIM in production. Tell us what you are building.

Pictures:James Murray in the Scriptorium (public domain); Card Division of the Library of Congress, 1900–1920 (public domain); Salle des catalogues, Bibliothèque Mazarine, Paris, Marie-Lan Nguyen (CC BY 2.0); Copyright card catalog drawer, Michael Holley Swtpc6800 (public domain); Type in sort case, Edinburgh City of Print (CC BY 2.0); Widener Library reading room, 1920 (public domain). Via Wikimedia Commons.