What is DKIM record and how to create it?

12/20/2019 1,219 People found this article helpful 139,599 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

1. What does DKIM do?
   DKIM is a process to validate sending domain names associated to email messages through cryptographic authentication. It achieves this by inserting a digital signature into the message header which is later verified by the receiving host to validate the authenticity of the sending domain.
   
   
2. What to consider before creating the DKIM record?
   Step 1: Determine which domains are allowed to send outbound mail on its behalf.
   Step 2: Create the DKIM public/private keys and the policy record. The ‘public’ key will be used in your public-facing DNS TXT record along with what’s called a policy record.
   
   The ‘private’ key will be used on your sending MTA. When an outbound message is sent from the sending MTA, it will add the private key to the message header for identification and validation by the receiving domain by way of the public key. This uses a new domain name identifier to digitally sign the message.
   
   Some online wizards that you can use to assist with the public/private key generation  and policy record creation for DKIM. Just specify your domain name and the selector being used.
   http://www.socketlabs.com/services/dkwiz
   
   Step 3:Create TXT records using the DKIM information created from these wizards. Be sure to include DKIM records for all of your applicable sending domains. These records will be included in your public facing DNS record for each sending domain. There are basically two types of DNS records used by Domain Keys; policy records and public key records.
   
    Policy records:
   A domain name using Domain Keys should have a single policy record configured.
   This is a DNS TXT-record with the name "_domainkey" prefixed to the domain name - for example "_domainkey.example.com". The data of this TXT-record contains the policy which is basically either "o=-" or "o=~". "o=-" means "all e-mails from this domain are signed", and "o=~" means "some e-mails from this domain are signed". Additional fields for test (t), responsible e-mail address (r), and notes (n) may also be included - for example "o=-;
   
   Step 4:Be sure that your existing sending MTA’s support DKIM. If not, upgrade them them so that they will have DKIM support. The sending MTA’s are your last touch systems of outbound mail flow and this is where DKIM signatures will attached to the outbound messages. An agent in the message transit path can sign the message content and selected header fields. The signature information is placed into a field of the RFC2822 message header.
   
   DKIM defines an authentication mechanism for email, using:
   A domain name identifier
   Public-key cryptography
   A DNS-based public key publishing service.
   
   
3. What is a DKIM "selector"?
   A selector is arbitrary string appended to the domain name, to help identify the DKIM public key. It is part of the DKIM signature, and is inserted into the DKIM-Signature header field.
   During the validation process, the selector adds an additional name component, allowing for differential DNS query names. There are varying DKIM DNS records associated with different selectors, under the same domain name.
   

   EXAMPLE: eslab.us._domainkey.example.com.

4. How is a DKIM signature recorded in a message? A DKIM signature is recorded as an RFC2822 header field for the signed message.
   

   EXAMPLE: 

   DKIM-Signature a=rs-sha1; q=dns;
        d=example.com;
        i=user@eng.example.com;
        s=jun2005.eng; c=relaxed/simple;
        t=1117574938; x=1118006938;
        h=from:to:subject:date;
        b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSb
        av+yuU4zGeeruD00lszZVoG4ZHRNiYzR

• Add a 'TXT' type DNS record, set value to the line
• Click the Add A TXT Record button
•  In the Name field enter a string that will distinguish this key from any others, also known as a selector prefix, e.g. Google._domainkey
• In the Data field enter your public encryption key
   

  EXAMPLE:   v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDeIhtCv3vUinyhKiKtZ8efjHGGo8gE1T+o7gLrvo6yRtdz9ICe6Fz5sgz0WYFW5nCV4DmaTcS25TfgWKsLggGSBdDxzShyvgdKJkG3b4+73rT/5opnRceqQf1qndnMZfkb/0/YciMKNQmigj9IGwKypj6CoIr1s46jRGy4Ws7LQIDAQAB

• Click Add TXT Record and allow up to 24hrs for the changes to take effect  
  For more reference, you can go to:http://www.dkim.org/

Related Articles

• SonicWall HES IP address blocklisted by UCEProtect or Backscatter
• How to add O365 connector for domain specific routing
• SonicWall Email Security on Hyper-V Platform

Categories

• Email Security > Email Security Appliance
• Email Security > Email Security Software
• Email Security > Hosted Email Security