Skip to content
Techno Trader
Home

Security & DNS

DKIM

Cryptographic signing of outbound mail so recipients can verify that a message really came from your domain and was not altered in transit.

Request a Quote Talk to an engineer
DKIM signing key module with an illuminated key indicator beside a corporate mail server
MESSAGE SIGNING · DKIM

Engineering capabilities

  • Key generation and selector strategy per sending platform
  • Signing enabled on tenant, gateway and application senders
  • Verification against real message headers
  • Scheduled key rotation

Security & hardening

  • 2048-bit keys where the platform supports them
  • Private keys held only on the signing platform
  • Retired selectors removed from the zone

DKIM signing and verification flow

Outbound mail is signed at the platform; receivers fetch the public key from your DNS and verify the signature before applying policy.

  1. 01

    Key management

    • Key pair generation
    • Selector naming
    • 2048-bit keys
    • Rotation schedule

    One selector per sending platform so keys can be rotated independently.

  2. 02

    Signing

    • Tenant signing
    • Gateway signing
    • Application signing

    Every legitimate sender signs; unsigned senders are either fixed or retired.

  3. 03

    Publication

    • selector._domainkey TXT
    • Public key record
    • Retired selectors removed

    Old selectors are cleaned out of the zone once traffic has moved.

  4. 04

    Verification

    • Receiver validation
    • Header inspection
    • DMARC alignment

    Verified against real message headers rather than assumed to be working.

Frequently asked questions

How often should DKIM keys be rotated?

Annually is a reasonable baseline for most organisations, and immediately if a signing platform is suspected of compromise. Rotation is planned so both selectors are valid during the change.

Does DKIM survive forwarding?

Usually yes, which is why it matters. As long as the signed headers and body are not altered, the signature validates after a forward where SPF would fail.

Can one domain have several DKIM keys?

Yes, and it normally should u2014 a separate selector for the mail tenant, the marketing platform and any application relay.

Scope the work before you commit budget

Send the environment details and get an engineered proposal with assumptions, risks and a rollback path.

Request a Quote Cost & ROI Estimator Contact engineering
Request a Quote WhatsApp