What is DKIM

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication standard that helps protect domains from email spoofing and message tampering.

When DKIM is enabled, outgoing emails are digitally signed before they are sent. Receiving mail servers use this signature to verify that:

• The email was sent from an authorised source.
• The message has not been altered during transmission.

If the signature is valid, the recipient's mail server can trust that the message is authentic.

What is a DKIM record?

A DKIM record is a DNS TXT record that contains the public key used to verify DKIM signatures. The DKIM record is formatted through a name, version, key type, and the public key itself.

When an email is received, the recipient's mail server checks the domain's DKIM record to validate the digital signature attached to the message. If the verification succeeds, the email is considered authentic and unchanged.

All domains with email hosting through Crazy Domains have a unique DKIM record. To use DKIM, ensure that email authentication is enabled for your hosting service.

Here's what your DKIM record looks like on your hosting manager page:

Why is DKIM important?

DKIM helps improve both email security and deliverability.

Key benefits include:

• Verifies that emails originate from an authorised domain.
• Helps prevent email spoofing and phishing attempts.
• Reduces the likelihood of messages going to Spam or Junk folders.
• Improves your domain's sending reputation over time.
• Increases trust in your email communications.

By helping receiving mail servers identify legitimate emails, DKIM plays an important role in protecting your domain and improving email delivery rates.

How does the DKIM record work?

DKIM verifies your emails using two actions:

1. The sending mail server generates a DKIM digital signature for the email.
2. The receiving mail server verifies that signature when the email arrives.

This process is made possible by a private and public key pair.

• The private key is kept secure on the sending mail server and is used to generate a digital signature for outgoing emails.
• The public key is published in your domain's DNS TXT record and is used by receiving mail servers to verify the signature.

When an email is sent, the server uses the private key to generate a digital signature based on parts of the email, including the message headers and content. When the email reaches the recipient, the receiving mail server retrieves the public key from the domain's DNS record and uses it to verify the signature.

If the signature is valid, the receiving server can confirm that the email is authentic and that the signed parts of the message have not been altered during transmission.

What to check after email hosting migration

If both your domain and email hosting are with Crazy Domains, no action is required. Your DKIM configuration should continue to work automatically.

If your DNS is hosted with a different provider, verify that your DKIM TXT record contains the correct public key for your current email service. This ensures that your emails continue to pass DKIM authentication checks after migration.

What encryption standard does Crazy Domains support?

Crazy Domains currently supports 2048-bit DKIM encryption across the following email hosting services:

• Titan Email
• cPanel Email
• Plesk Email
• Google Workspace (GWS) Email
• Exchange On-Premise

2048-bit encryption provides a stronger level of email authentication security and helps protect against spoofing and unauthorised email activity.