Engineering, made clearer.Find a tool /
Learn · Practise · Understand

Learn DKIM

DKIM signs selected message headers and the body with a private key. Receivers retrieve the matching public key from a selector under the signing domain.

3 sections · 10 explained questions · About 10 minutesAll lessons →

Read each short explanation, work through the example, then answer a pop quiz. Every answer explains the reasoning. Incorrect answers unlock a fresh question on the same idea; the full lesson contains ten questions.

01Understand the basics

Ready to learn

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to a message. The signer selects a domain in d= and a selector in s=. Receivers retrieve the public key from selector._domainkey.domain and verify that the signed content has not changed.

Section 1 question · 4 variations
What does a DKIM pass prove?

02Publish the selector key

Ready to learn

A DKIM key record contains tag-value fields. p= carries the public key; an empty p= revokes the selector. Syntax checks do not prove that the matching private key is protected or that mail is being signed.

Try a different value

Move the slider or use the arrow keys to see what changes.
2 published selectorsNew mail uses the current private keyOld public keys remain only while delayed mail may still need verificationRetire unused keys after verification
Section 2 question · 3 variations
Where is selector s1 for example.com published?

03Rotate without breaking verification

Ready to learn

Create a new selector and key, publish the new public key, confirm it resolves, then switch signing. Retain the old public key while delayed messages bearing the old selector may still be verified, and remove it when it is no longer needed.

Section 3 question · 3 variations
Why keep the former selector published briefly after changing signing keys?

Put it to work

Apply what you’ve learned using the related tools.

DKIM Public Key Record Analyser →Authentication-Results Header Analyser →