# DKIM

DKIM (DomainKeys Identified Mail, RFC 6376) is a signature a sending server adds to a message, verified by the receiver against a public key the domain publishes in DNS under a selector.

Date: 2026-09-13

DKIM, DomainKeys Identified Mail, is the mechanism of RFC 6376 by which a sending server signs a message with a private key and the receiver verifies the signature against a public key the domain publishes in DNS. The signature covers chosen headers and the body, so a message that is altered in transit, or that merely claims a domain it was never signed by, fails verification.

## What Spaw answers

The domain endpoint reports `dkim_selectors`: which of the common selector names publish a key under `<selector>._domainkey.<domain>`. An empty list means none of the common names answered, which is not the same as no DKIM at all — a domain may sign under a selector nobody else uses — and null means the lookups failed. The free DKIM checker reads the same list.

## What it does not mean

A published key proves the domain can sign, not that a given message was signed or that the signature aligned with the visible sender. DMARC is the policy that ties DKIM and SPF to the address a person sees.

Reference: https://spaw.co/glossary/dkim