What does DKIM stand for?
DKIM stands for DomainKeys Identified Mail. An email authentication method in which the sending domain signs messages with a private key and publishes the public key in DNS, so receivers can verify the message was not altered.
With DKIM the sending mail system signs selected headers and the body of each message with a private key and adds the signature as a header. The matching public key is published in DNS under a selector name. A receiver fetches the key and verifies the signature, which shows that the signing domain took responsibility for the message and that the signed parts were not changed on the way. DKIM is defined in RFC 6376.
DKIM in practice: an example
A message from example.com carries a DKIM-Signature header with d=example.com and s=mail2026. The receiver looks up mail2026._domainkey.example.com, gets the public key and verifies the signature. If a relay had altered the body, verification would fail.
What DKIM is confused with
DKIM vs SPF: what is the difference?
SPF authorizes sending servers by address. DKIM signs the message, so it still verifies after forwarding as long as the content is unchanged. What SPF stands for
DKIM vs DMARC: what is the difference?
DKIM proves a domain signed the message. DMARC checks that this domain matches the visible From address and sets the policy. What DMARC stands for
Which exams cover DKIM?
DKIM is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
- CySA+ CS0-004: on the acronym list, not tied to one objective.
- A+ 220-1201 and 220-1202: 220-1201 2.0 (Networking).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which problem does DKIM detect that SPF cannot?
- A message whose signed content was modified in transit
- A full mailbox
- A slow DNS server
- A weak user password
Show the answer
A. A message whose signed content was modified in transit. DKIM's signature covers message content, so a change breaks verification. SPF only looks at the sending server.
2. Where does a receiving server get the key to verify a DKIM signature?
- From the sender's DNS, under the selector named in the signature
- From the message attachment
- From the recipient's address book
- From the CA that issued the web certificate
Show the answer
A. From the sender's DNS, under the selector named in the signature. The public key is a DNS record at selector._domainkey.domain. No certificate authority is involved.
Sources: RFC 6376: DomainKeys Identified Mail (DKIM) Signatures; NIST SP 800-177 Rev. 1, Trustworthy Email. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.