Every tool you need for AI sales outreach

Independent AI sales assistant

An extra pair of hands for your sales growth

Our best AI emails

Clients' favorite emails generated by AiSDR

AiSDR Website Illustrations | Growth icon 111
Case studies

See the real results from our clients

AiSDR Website Illustrations | Starts and lightning icon 1
Speak with our AI

Let AiSDR try and convince you to book a meeting with us

Explore Q2 2024 outreach benchmarks Grab my copy
Explore Q2 2024 outreach benchmarks Grab my copy
<Back to blog

What is DKIM?

What is DKIM?
Jul 2, 2024
Oleg Zaremba

DKIM is one of your lines of defense in email security. See how DKIM ensures message integrity while verifying a sender’s domain

6m 48s reading time

If all it took to keep your email outreach from landing in spam was one simple step, would you take it?

DomainKeys Identified Mail (DKIM) is that step. 

In tandem with SPF and DMARC, DKIM works to ensure robust email deliverability. Along with keeping your outbound emails out of spam, it also prevents malicious parties from impersonating you.

Here’s a closer look at what DKIM is, how it works, and how you can set it up.

What is DKIM?

DomainKeys Identified Mail is one of a trio of email authentication and security protocols that work together to protect your emails from tampering and spoofing: SPF, DMARC, and DKIM

As implied by its name, DKIM verifies that this email truly comes from your domain and hasn’t been altered or tampered with in transit.

So how does DKIM work?

In simple terms, DKIM uses a string of text known as a key to authenticate your email.

And just like there are two sides to every coin, there are two keys to every DKIM:

  • Private key – The private key is kept secret by the sender’s server. A signature is then applied to every email from the sender using this key.
  • Public key – The public key is published in the sender’s DNS records so that recipients’ servers can access the key to check and verify the sender’s signature.

The DKIM verification process is like running a person’s fingerprints in a database.

Similar to the private key, a person’s fingerprints are unique and can only be provided by the person. And like the public key, authorities can access a database to check the validity of the person’s fingerprints. If the prints match, then the identity is confirmed. 

And in DKIM, the receiver’s mail server will access the public key to verify the private key and confirm the authenticity of an email. If the check passes, your email proceeds to the recipient’s inbox.

If an email arrives without a DKIM signature, chances are it’s not actually from the person who supposedly sent it. 

When this happens, your email service provider (ESP) follows a policy that outlines the next step, which is usually forwarding the email to spam or blocking it. 

You can specify your own policy and get better insights into your email deliverability by setting up DMARC for your domain.

What is a DKIM signature?

The DKIM signature is an encrypted header that’s added to your email. This header is invisible to your recipient, but it can be read by their mail server. 

A DKIM signature contains all the information a server needs to validate your message:

  • Your domain name
  • Your email address
  • The DKIM version used by your mail server
  • The public key

You can protect your emails with a DKIM signature only when you have a public key that can be used to verify it.

What is a DKIM record?

A DKIM record is a specially formatted line of text that stores the public key. A recipient’s email server will use the DKIM record to verify your DKIM signature.

A DKIM record consists of the following:

  • Record name
  • Record version
  • Key type
  • The key itself

With most Domain Name System (DNS) providers, you can view your DKIM record in the DNS Settings menu.

How does DKIM work?

The process of DKIM encryption and verification has three stages:

  • Setting up the private/public DKIM key pair
  • Sending a signed DKIM message
  • Verifying a signed DKIM message

DKIM works using a private/public key pair. 

After you create these, your private key is stored safely on your server or with your DNS provider. The public key is added to the DNS records for your domain so it can be accessed by anyone who needs to verify your email.

Unless you run your own mail server, you will create a private DKIM key with your DNS provider and store it on their servers. 

Whenever you send a message, your DNS provider will use your private key to create a unique DKIM signature and add it to the email header.

The receiver’s mail server will validate the DKIM signature by checking if:

  • It uses the same DKIM version as the sending server
  • The sender’s domain matches the one in the signature
  • The sender’s name matches the one in the signature

After this, the receiving server requests the public DKIM key and uses it to decrypt the signature. 

The server computes a hash from the data, similar to a teacher checking a student’s homework. Then, it compares this hash with the one in the DKIM signature. If they match, the email’s authenticity is confirmed and the message passes DKIM.

Why is DKIM important?

On February 1, 2024, Google mandated DKIM and Sender Policy Framework (SPF) for everyone sending emails to Gmail accounts. But even when DKIM isn’t mandatory, setting it up gets you a range of benefits.

Greater email security and trust

Using DKIM establishes you as a reputable sender. Your emails will be generally perceived as safe by your prospects and customers, which can improve your open rate.

Neglecting DKIM can be detrimental to your long-term customer relationships. When your emails go to spam or junk, the recipient either misses them entirely or has to root around to find them. Over time, they’ll disengage.

Improved email deliverability

Enabling DKIM improves your domain reputation with internet service providers (ISPs). When you send emails that seldom (if ever) bounce or get sent to spam, the algorithms adjust to view your domain more favorably so that your next campaigns enjoy higher deliverability.

Protection against spoofing and phishing

Adopting DKIM and its partner email protocol SPF makes it more difficult for malicious parties to pose as you. 

The email’s subject line and body are protected by a DKIM signature. When the signature is invalid or absent, this immediately flags the email as suspicious to the receiving server.

DMARC compliance

Another reason to adopt DKIM is to comply with Domain-based Message Authentication, Reporting, and Conformance (DMARC) requirements. When your recipient uses DMARC, all messages that fail the DKIM check might automatically get flagged as spam.

How to set up DKIM

The DKIM set-up process varies slightly for different mail providers, but it generally follows the same three steps.

Generate DKIM keys

First of all, you need to generate your DKIM keys. 

In Squarespace (formerly Google Domains), you can do it by simply choosing your domain in the Selected domain menu (Admin console > Apps > Google Workspace > Gmail > Authenticate email > Selected domain) and clicking Generate new report

For other providers, follow their specific instructions.

You will need to choose the DKIM key bit length. Go for 2048 if your provider supports it as a longer key is safer. When that’s not an option, your emails will be reasonably secure with 1024.

After you obtain your public DKIM key, copy its value for the next step.

Add the DKIM record to DNS

This step is pretty straightforward. Open your domain host’s DNS setting. In the DNS records section, add a new .txt record and insert the value you copied in the previous step. 

Congratulations! You’ve set up your public DKIM key.

Note that you’ll need to wait 48 hours (or more if specified by your mail provider) before proceeding to the next step.

Configure your email server to sign outgoing emails

Again, if you’re using a server other than Squarespace, check their instructions on adding a DKIM signature to your emails. 

With Google, just go back to the Selected domain menu, choose your domain, and click Start Authentication. Then, look at the status at the top of the page. When it changes to Authenticating email with DKIM, you’re all set. 

In Microsoft 365, you simply need to toggle the option Sign messages for this domain with DKIM signatures.

And you’re set! With DKIM, your outbound emails are safer from spoofing, and mail servers are less likely to automatically block your outreach.

Did you enjoy this blog?
1. What is DKIM? 2. What is a DKIM signature? 3. What is a DKIM record? 4. How does DKIM work? 5. Why is DKIM important? 6. How to set up DKIM
AiSDR | Website Illustrations | LinkedIn icon | 1AiSDR Website Illustrations | LI iconAiSDR | Website Illustrations | X icon | 1AiSDR Website Illustrations | X iconAiSDR | Website Illustrations | Insta icon | 1AiSDR Website Illustrations | IG icon 2AiSDR | Website Illustrations | Facebook icon | 1AiSDR Website Illustrations | FB icon
AiSDR Website Illustrations | Best AI Tools for Primary and Secondary Market Research | Preview
Get an AI SDR than you can finally trust. Book more, stress less.
You might also like:
[Leadership Nuggets] How AiSDR Rebuilt a Client’s Sender Reputation for Cold Outreach
[Leadership Nuggets] How AiSDR Rebuilt a Client’s Sender Reputation for Cold Outreach
Viktoria Sinchuhova
Viktoria Sinchuhova •
Jun 20, 2024 •
3m 7s
If your sender reputation tanks, it's not the end of the world. Here's how our customer success team rebuilt a client's sender reputation
Read blog>
What are SPF, DKIM, and DMARC?
What are SPF, DKIM, and DMARC?
Oleg Zaremba
Oleg Zaremba •
May 14, 2024 •
2m 35s
Want to stop malicious actors from hijacking your emails? Make sure to set up the trio of email security protocols: SPF, DKIM, & DMARC
Read blog>
How to Set Up a New Email Domain
How to Set Up a New Email Domain
Oleg Zaremba
Oleg Zaremba •
Jul 3, 2024 •
6m 49s
A professional email address is key for making a good impression in sales. For that, you need a custom domain. Here's how to set one up
Read blog>
How to Warm Up an Email Account
How to Warm Up an Email Account
Joshua Schiefelbein
Joshua Schiefelbein •
Feb 5, 2024 •
8m 25s
A cold mailbox will stop your outreach faster than you can say "Go!" Check out how you can properly warm up your accounts
Read blog>
See how AiSDR will sell to you.
Share your info and get the first-hand experience
See how AiSDR will sell to you