RFC 6376 — DKIM Signatures

Q: What does the Introduction section cover in RFC 6376 — DKIM Signatures?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6376 — DKIM Signatures. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Signature Process section cover in RFC 6376 — DKIM Signatures?

The Signature Process section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6376 — DKIM Signatures. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the DKIM-Signature Header section cover in RFC 6376 — DKIM Signatures?

The DKIM-Signature Header section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6376 — DKIM Signatures. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the DNS Key Record section cover in RFC 6376 — DKIM Signatures?

The DNS Key Record section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6376 — DKIM Signatures. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 6376 — DKIM Signatures?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6376 — DKIM Signatures. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 6376 — DKIM Signatures

DomainKeys Identified Mail (DKIM) Signatures — email authentication mechanism using cryptographic signatures to verify that email messages originate from authorized sending domains.

Standards Track September 2011 ISO 27001

1. Introduction

▶

DKIM provides cryptographic authentication of email sender domains by adding digital signatures to message headers. The receiving mail server verifies the signature using the sender's public key published in DNS.

ISO 27001 Relevance: A.8.12 (Data Leakage Prevention) — DKIM helps prevent email spoofing that could lead to data exfiltration via phishing. A.8.21 (Security of Network Services) — email authentication as a network service security control.

2. Signature Process

▶

  Sending MTA                    DNS                     Receiving MTA
  ┌──────────┐                                          ┌──────────────┐
  │ 1. Hash  │                                          │ 4. Query DNS │
  │ headers  │                                          │ for public   │
  │ + body   │                                          │ key          │
  │          │                                          │              │
  │ 2. Sign  │                  ┌─────┐                 │ 5. Verify    │
  │ with     │──DKIM-Signature─>│ TXT │<── lookup ──────│ signature    │
  │ private  │     header       │ RR  │                 │              │
  │ key      │                  └─────┘                 │ 6. Pass/Fail │
  └──────────┘                                          └──────────────┘

3. DKIM-Signature Header

▶

Key fields in the DKIM-Signature header:

Tag	Name	Description
v	Version	MUST be '1'
a	Algorithm	rsa-sha256 (MUST), ed25519-sha256
d	Domain	Signing domain (e.g., blacklabs.team)
s	Selector	DNS selector for key lookup
h	Headers	Signed header fields (From, To, Subject, etc.)
bh	Body Hash	Hash of canonicalized message body
b	Signature	Base64 encoded signature value

4. DNS Key Record

▶

The public key is published as a DNS TXT record:

  selector._domainkey.blacklabs.team IN TXT (
    "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN..." )

Key rotation: Use selectors to enable zero-downtime key rotation
Key size: RSA 2048-bit minimum (1024-bit DEPRECATED per A.8.24)
Algorithm: rsa-sha256 (RECOMMENDED), Ed25519 for modern deployments

5. Security Considerations

▶

Header protection: Always sign From, To, Subject, Date, Message-ID headers
Body length limit: Avoid l= tag — allows content appending attacks
Key management: Rotate keys periodically, use 2048-bit+ RSA
DMARC integration: DKIM works with SPF (RFC 7208) and DMARC (RFC 7489) for comprehensive email authentication
Replay: DKIM does not prevent replay of signed messages — DMARC provides additional policy enforcement