{"componentChunkName":"component---src-templates-blog-post-js","path":"/blog/whats-a-DKIM-record/","result":{"data":{"site":{"siteMetadata":{"title":"The Official MailPace Blog","author":"Paul, founder of MailPace"}},"mdx":{"id":"b66a423b-bea6-53b0-b710-101f5c4d2bae","excerpt":"A DomainKeys Identified Mail (DKIM) record is a piece of text that you can add to your Domain Name System (DNS). The record is a special key that gives email…","body":"var _excluded = [\"components\"];\n\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"title\": \"What's a DKIM Record?\",\n  \"date\": \"2021-02-21T22:00:03.284Z\",\n  \"description\": \"DKIM records are DNS entries that help verify the origin domain of an email\"\n};\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, _excluded);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, \"A DomainKeys Identified Mail (DKIM) record is a piece of text that you can add to your Domain Name System (DNS). The record is a special key that gives email providers (such as Gmail or Outlook) a way to verify if an email was created by the owner of a domain. Email providers can check each email received against this record to see if it is likely to be spam or forged. \"), mdx(\"p\", null, \"Setting up DKIM will help reduce the chances of your emails being categorized as spam, and help others build confidence that the contents of your emails have come from you, without being tampered with.\"), mdx(\"h2\", null, \"Background\"), mdx(\"p\", null, \"While we can use technologies like the Sender Policy Framework (SPF) to validate that an email came from the server that it says it came from (more on SPF \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"/blog/whats-an-spf-record\"\n  }, \"here\"), \"), we need a way to ensure that the email itself was written by the owner of the domain, or someone allowed to write emails on their behalf. \"), mdx(\"p\", null, \"We need to do this because most domains use a shared email server or provider to send emails, so the email contents themselves need to be verified in case a hacked server or malicious shared account is used to send spam or forged emails.\"), mdx(\"p\", null, \"One of the other cool uses of DKIM is to validate that an email hasn\\u2019t been tampered with, which has been used in some \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://www.wikileaks.org/DKIM-Verification.html\"\n  }, \"very high profile situations\"), \" to prove that the email must have come from the original domain, without modification. \"), mdx(\"h2\", null, \"So how do DKIM records work?\"), mdx(\"p\", null, \"If you own a website or domain, you\\u2019ll have access to the DNS records for that domain through your registrar. Only the owner of a domain can modify these records, which means that \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"whatever appears in those records, we can assume was put there by the owners of the domain\"), \". By combining this with cryptography, we can create a method (DKIM) to validate the contents of an email.\"), mdx(\"p\", null, \"This is where \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://en.wikipedia.org/wiki/Public-key_cryptography\"\n  }, \"Public-Key Cryptography\"), \" comes in, one of the most important pieces of technology in existence today. Public-Key cryptography is a cryptographic system that consists of two keys, Public and Private. It\\u2019s used in everything from Bitcoin to SSH, and we can use it to prove that an email originates from the owner of the domain.\"), mdx(\"p\", null, \"To do this the person writing the email will make a \\u201Csignature\\u201D using their private key and include it in the email headers. This signature is calculated by taking the contents of the email and running it through a one-way function. This one-way function produces an output that can be validated by the public key. The exact way keys and signatures are calculated and validated is really interesting, and worthy of an entire article on its own, but you don\\u2019t need to know the specifics to understand DKIM.\"), mdx(\"p\", null, \"This means that \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"emails with a signature attached that match the public key can only have been created by someone with the corresponding private key\"), \". The private key is kept private by the original author, so we can be confident in the authenticity of the message.\"), mdx(\"p\", null, \"With DKIM we put the public key in our DNS record (proving that this public key is the right key for our domain), and just before the email is sent we sign it with the private key. When the email is received by the end user their email server will lookup the DNS records for the domain in the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"From\"), \" part of the email, download the public key and validate it against the signature. If the validation passes, the email must have come from that domain, or someone who has the private key for that domain.\"), mdx(\"h2\", null, \"What does a DKIM record look like?\"), mdx(\"p\", null, \"Here\\u2019s the DKIM record for \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://mailpace.com\"\n  }, \"MailPace.com\"), \":\"), mdx(\"pre\", {\n    \"className\": \"grvsc-container default-dark\",\n    \"data-language\": \"\",\n    \"data-index\": \"0\"\n  }, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"grvsc-code\"\n  }, mdx(\"span\", {\n    parentName: \"code\",\n    \"className\": \"grvsc-line\"\n  }, \"mailpace._domainkey\"), \"\\n\", mdx(\"span\", {\n    parentName: \"code\",\n    \"className\": \"grvsc-line\"\n  }, \"v=DKIM1; h=sha256; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9iJpPrQh0HoQPYAMC+eytJp1Ey9uz932X/e+6kzMa9hGZQEYcj5/bOgjHN0Sgi+4ampvwlGY4jPC0aL1fMM9fpmXhCbijvGaWYatPGkngL+kXB0BqS512kQH4IiaGnPKOFErplW9192KjYXdHJFSLkKNKBlxn09CpAMUYvzTMzQIDAQAB;\"))), mdx(\"p\", null, \"Let\\u2019s break it down:\"), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"The first line \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"mailpace._domainkey\"), \" is the name of the \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"TXT\"), \" record, and is used as a selector to identify the record among other DNS entries. The matching DKIM signature will have this selector included in the header, so the receiving email server knows where to look. You can have multiple DKIM entries, provided the selectors are different, which can be useful if you want to send using different private keys. If you need to support subdomains, they can be appended to the end e.g. \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"mailpace._domainkey.sub.domain\"))), mdx(\"p\", null, \"The next line has three parts:\"), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"v=DKIM1\"), \" tells us that this is an DKIM record, and it\\u2019s a Version 1 record. There\\u2019s only one version at present, so this will always be the same for the forseeable future\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"h=sha256;\"), \" This is the hash method used to create the public/private key and sign the email. This is important as it\\u2019s the algorithm the email server should use to validate the signature. There are several supported algorithms, but a large number are outdated and potentially insecure, \", mdx(\"strong\", {\n    parentName: \"li\"\n  }, \"for you now you should use \", mdx(\"inlineCode\", {\n    parentName: \"strong\"\n  }, \"sha256\")), \" - in theory \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"Ed25519\"), \" is also viable and produces nice short keys, however when testing we found that some email servers didn\\u2019t successfully validate these keys\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"Finally we have the actual public key in the \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"p=\"), \" - this is the public key used to validate the email signature\")), mdx(\"p\", null, \"To add this to your DNS record, open up your domain registrar or DNS management console, and add a new \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"TXT\"), \" record with the text as your content and name as above. If you\\u2019re using a service to send emails on your behalf your email service provider will give you the exact record details you need, if you\\u2019re sending emails from your own server you\\u2019ll need to write your own record that matches your DKIM implementation (particularly the selector and algorithm choice), which will be heavily dependent on the email server you\\u2019re using.\"), mdx(\"p\", null, \"Simple, right?\"), mdx(\"h2\", null, \"How to use DKIM with MailPace\"), mdx(\"p\", null, \"The good news is that MailPace signs all emails by DKIM automatically for you, we also generate and store the private keys, so all you need to do is add the public key we provide onto your DNS record, and DKIM will work like magic.\"), mdx(\"p\", null, \"When you setup your first domain, we\\u2019ll take you through an onboarding process to set things up, and you can re-do the verification process at any point on the Verification section of your domain.\"), mdx(\"p\", null, \"Note that \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"we don\\u2019t let anyone send emails through our platform without DKIM validation\"), \" - it\\u2019s a simple thing that\\u2019s too easy for spammers to abuse if we don\\u2019t enforce it. If you\\u2019re using an email provider that doesn\\u2019t enforce DKIM validation, find a new provider, it\\u2019s not hard to do and and it really does help prevent spam.\"), mdx(\"h2\", null, \"Further reading\"), mdx(\"p\", null, \"If you want to learn everything there is to know about DKIM, there are three RFC (\\u201CRequest For Comments\\u201D) specifications to read here:\"), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, mdx(\"a\", {\n    parentName: \"li\",\n    \"href\": \"https://tools.ietf.org/html/rfc6376\"\n  }, \"RFC 6376\"), \" - The current main specification (September 2011)\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, mdx(\"a\", {\n    parentName: \"li\",\n    \"href\": \"https://tools.ietf.org/html/rfc8301\"\n  }, \"RFC 8301\"), \" - Updated key sizes and algorithms (January 2018)\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, mdx(\"a\", {\n    parentName: \"li\",\n    \"href\": \"https://tools.ietf.org/html/rfc8463\"\n  }, \"RFC 8463\"), \" - Adding Ed25519 to supported algorithms (September 2018)\")), mdx(\"p\", null, \"Happy reading!\"), mdx(\"style\", {\n    \"className\": \"grvsc-styles\"\n  }, \"\\n  .grvsc-container {\\n    overflow: auto;\\n    -webkit-overflow-scrolling: touch;\\n    padding-top: 1rem;\\n    padding-top: var(--grvsc-padding-top, var(--grvsc-padding-v, 1rem));\\n    padding-bottom: 1rem;\\n    padding-bottom: var(--grvsc-padding-bottom, var(--grvsc-padding-v, 1rem));\\n    border-radius: 8px;\\n    border-radius: var(--grvsc-border-radius, 8px);\\n    font-feature-settings: normal;\\n  }\\n  \\n  .grvsc-code {\\n    display: inline-block;\\n    min-width: 100%;\\n  }\\n  \\n  .grvsc-line {\\n    display: inline-block;\\n    box-sizing: border-box;\\n    width: 100%;\\n    padding-left: 1.5rem;\\n    padding-left: var(--grvsc-padding-left, var(--grvsc-padding-h, 1.5rem));\\n    padding-right: 1.5rem;\\n    padding-right: var(--grvsc-padding-right, var(--grvsc-padding-h, 1.5rem));\\n  }\\n  \\n  .grvsc-line-highlighted {\\n    background-color: var(--grvsc-line-highlighted-background-color, transparent);\\n    box-shadow: inset var(--grvsc-line-highlighted-border-width, 4px) 0 0 0 var(--grvsc-line-highlighted-border-color, transparent);\\n  }\\n  \\n  .default-dark {\\n    background-color: #1E1E1E;\\n    color: #D4D4D4;\\n  }\\n\"));\n}\n;\nMDXContent.isMDXComponent = true;","frontmatter":{"title":"What's a DKIM Record?","date":"February 21, 2021","description":"DKIM records are DNS entries that help verify the origin domain of an email"}}},"pageContext":{"slug":"/whats-a-DKIM-record/","previous":{"fields":{"slug":"/send-attachments-with-ohmysmtp/"},"frontmatter":{"title":"Send attachments with transactional emails"}},"next":{"fields":{"slug":"/how-to-catch-spam-with-rspamd/"},"frontmatter":{"title":"How to catch spam with Rspamd"}}}},"staticQueryHashes":["1956864136","63159454"]}