DKIM: what it’s not

An ESP twittered this past week about their new DKIM implementation going live. They were quite happy with themselves. Unfortunately, in their blog post, they mentioned 3 things that DKIM would provide for their customers, and got it wrong on all 3 points. Their confusion is something that a lot of people seem to get wrong about DKIM so I thought I would explain what was wrong.

  1. “[M]essages are affirmatively identified as coming from our servers…” DKIM isn’t necessary to affirmately identify mail as coming from a particular server or IP address. In fact, one of the major benefits of DKIM is that it allows sender reputation to be independent of IP address reputation.
  2. “Messages are more likely to be delivered to the inbox rather than the spam folder.” Not necessarily. The presence or absence of a valid DKIM signature is unlikely to increase inbox delivery on its own. Having a valid DKIM signature and a good reputation for that sender may result in better inbox delivery. The ISPs aren’t currently, are are unlikely to, offer preferential inbox delivery just on the basis of a DKIM signature.
  3. “Larger ISPs are heading towards requiring a DKIM signature on all incoming email. We are providing this feature now to avoid any issues in the future.” This is currently untrue and it is extremely unlikely that any ISPs will ever *require* a valid DKIM signature on all incoming email. The internet is just too large and too varied for ISPs to expect that all wanted mail will be DKIM signed.

DKIM is a way to authenticate email. Senders with good reputation will be able to take advantage of that reputation no matter what IP address they send mail from.

Senders should encourage ESPs and MTA vendors to implement DKIM signing sooner rather than later. However, DKIM signing alone will not improve delivery.


  1. Jim Fenton says

    I have a slightly different take on these:

    1. It’s the other part of the ESP’s statement, “…and will benefit from the positive reputation they have,” that I disagree with. With domain-based reputation it’s the domain, not the mail server, that has a reputation, as you point out.

    2. The presence of a DKIM signature does allow a domain to start establishing a (hopefully positive) reputation with the ISP, which in turn can result in increased delivery to the inbox without further action on the domain’s part. It’s true that it’s not a direct consequence of signing though.

    3. I completely agree with you on this; there’s no way that I can see any ISP requiring signatures, except possibly if the author domain publishes an ADSP record requesting this.

  2. Nazzareno Gorni says

    I agree with Laura and I have a question.
    Which is the impact of the DKIM selector parameter (s=)?

  3. J.D. says

    It’s unlikely that s= will have any impact on deliverability at all.

  4. laura says

    I have been told, in no uncertain terms, that s= should not be used for reputation and if it is that Internet Greybeards will show up on your doorstep and beat you with standards documents.

  5. steve urow says

    I send out a newsletter and want to implement DKIM, but I do not see the nuts and bolts, step by step of doing so.

  6. laura says


    You can get some instructions on Step by step depends on what MTA software you are using, so you’ll want to talk to your vendor or look at the opensource tools available for your particular mail software.


Your email address will not be published. Required fields are marked *

  • OTA joins the ISOC

    The Online Trust Alliance (OTA) announced today they were joining forces with the Internet Society (ISOC). Starting in May, they will operate as an initiative under the ISOC umbrella. “The Internet Society and OTA share the belief that trust is the key issue in defining the future value of the Internet,” said Internet Society President and CEO, Kathryn Brown. “Now is the right time for these two organizations to come together to help build user trust in the Internet. At a time when cyber-attacks and identity theft are on the rise, this partnership will help improve security and data privacy for users,” added Brown.No Comments

  • Friday blogging... or lack of it

    It seems the last few Friday's I've been lax on posting. Some of that is just by Friday I'm frantically trying to complete all my client deliverables before the weekend. The rest of it is by Friday I'm just tired. Today had the added complication of watching the Trumpcare debate and following how (and how soon) it would affect my company if it passed. That's been a bit distracting, along with the other stuff I posted about yesterday. I wish everyone a great weekend.1 Comment

  • Indictments in Yahoo data breach

    Today the US government unsealed an indictment against 2 Russian agents and 2 hackers for breaking into Yahoo's servers and stealing personal information. The information gathered during the hack was used to target government officials, security employees and private individuals. Email is so central to our online identity. Compromise an email account and you can get access to social media, and other accounts. Email is the key to the kingdom.No Comments