Contents
What does a DKIM signature look like?
The DKIM signature header is made up of different informational elements that are represented by the use of tag=value pairs. The tag is usually a single letter followed by an equal sign (=). The value of each tag indicates a specific piece of information about the sender, message, and public key location.
How do I read a DKIM signature?
To validate the DKIM signature, the email receiver will run a DNS query to search for the public key for that domain. The variables provided in the DKIM signature are used to determine where to look for this key. If the key was found, it can be used to decrypt the DKIM signature back the to original hash values.
Is there a tool to check DKIM keys?
Update — Due to the recently released vulnerability related to the use of weak cryptographic DKIM keys, I wrote a tool to check DKIM records and determine their public key length: DKIM Key Checker Google announced today they have added the ability for Google Apps customers to sign outbound email using the DKIM (DomainKeys Identified Mail) standard.
What happens when a DKIM authentication check fails?
DKIM check fails happens when the DKIM authentication checks fail. Here are possible reasons for check failures: DKIM signature domain and sender (Header From) domain do not align; DKIM public key record, published in DNS, is incorrect or is not published at all;
What does DKIM do to an email address?
DKIM allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message.
How does the MTA verify a DKIM signature?
After receiving the email, the recipient MTA can verify the DKIM signature by recovering the signer’s public key through DNS. The recipient MTA then uses that key to decrypt the hash value in the email’s header and simultaneously recalculate the hash value for the mail message received.