---
title: DKIM
description: DomainKeys Identified Mail — cryptographic email signatures that prove a domain authorized the message; SES supports Easy DKIM and BYODKIM.
url: https://www.factualminds.com/glossary/dkim/
publishDate: 2026-07-22
updateDate: 2026-07-22
---

# DKIM

> DomainKeys Identified Mail — cryptographic email signatures that prove a domain authorized the message; SES supports Easy DKIM and BYODKIM.

## Definition

**DKIM** (DomainKeys Identified Mail) attaches a cryptographic signature to outbound messages. Receivers look up the public key in DNS (`selector._domainkey.example.com`) and verify that headers/body were authorized by the signing domain. For **DMARC**, the DKIM signing domain must **align** with the visible From domain (organizational domain match under relaxed alignment).

## When to use it

- All Amazon SES production sending (Easy DKIM is the default path)
- Multi-ESP setups where you bring your own key (**BYODKIM**) for consistent selectors across vendors
- Bulk-sender compliance (Google, Yahoo, Microsoft) requiring authenticated, aligned mail

## When not to use it

- Signing with a third-party ESP domain that does not align to your From domain if you need DMARC pass
- Rotating keys without dual-publishing DNS long enough for in-flight mail

## Tips

- Prefer **2048-bit** keys where supported (SES Easy DKIM supports them)
- Keep selector DNS CNAMEs (Easy DKIM) or TXT public keys (BYODKIM) under change control
- Verify alignment on live messages via `Authentication-Results` headers, not console checkmarks alone

## Gotchas

### Serious

- Body/header modifications by intermediate relays that break signatures
- From domain `marketing.brand.com` signed as `esp-mail.com` without alignment → DMARC fail

### Regular

- Leaving old selectors published forever after rotation (harmless but noisy)

## Related FactualMinds content

- [DMARC](/glossary/dmarc/) · [SPF](/glossary/spf/) · [BIMI](/glossary/bimi/) · [Amazon SES](/glossary/amazon-ses/)
- [BIMI implementation guide](/blog/bimi-amazon-ses-implementation-guide/)

## Related AWS Services

- aws-ses
- aws-ses-migration

## Related Posts

- bimi-amazon-ses-implementation-guide
- how-to-migrate-from-sendgrid-to-amazon-ses
- amazon-ses-cold-email-b2b-compliance-deliverability-2026

---

*Source: https://www.factualminds.com/glossary/dkim/*