In this DomainKeys Identified Mail (DKIM) setup guide, we walk you through the steps on how to set up DKIM correctly, test it, avoid common pitfalls, and fix common mistakes.
How to Set Up DKIM Step by Step
You’ll need a few things to start DKIM setup:
- A list of all your domains that send emails
- A DKIM package for your email server
- A DKIM key wizard (which are readily found online for free)
- Access to your DNS (or someone who does)
- A DKIM record checker (which are also readily found online for free)
Then you can proceed along the path to a correct DKIM setup:
How Do I Prevent Spoofing?
DKIM helps improve email deliverability and when combined with SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), it can play a critical role in preventing email spoofing.
Example of DKIM passing rate for Office 365 as third-party sending domain for "dummy" financial institution in backend of Fortra DMARC Protection.
Email spoofing occurs when a fraudster sends an email that appears to be sent from someone else by using a forged sender address. For example, fraudsters may send emails to your employees that appear to come from your CEO or send emails to your customers that appear to come from your organization.
This is a common identity deception technique used to trick recipients into revealing sensitive information, including login credentials or financial data. Email spoofing is frequently used in phishing and BEC scams.
You achieve this by adding SPF, DMARC and BIMI, in addition to DKIM:
- Sender Policy Framework (SPF): SPF is an email authentication standard that allows domain owners to specify which servers are authorized to send email with their domain in the “Make From:” email address. SPF allows receiving email systems to query DNS to retrieve the list of authorized servers for a given domain. If an email message arrives via an authorized server, the receiver can consider the email legitimate.
- Domain-based Message Authentication, Reporting & Conformance (DMARC): DMARC is an email authentication standard that works as a policy layer for SPF and DKIM to help email receiving systems recognize when an email isn’t coming from a company’s approved domains, and provides instructions to email receiving systems with email on how to safely dispose of unauthorized email.
- Brand Indicators for Message Identification (BIMI): BIMI is an email specification that works in conjunction with DMARC to enable companies to have their logos displayed next to their email messages in a recipient’s email client. Not only does this enhance brand visibility in crowded inboxes, it also verifies that the email is legitimate and comes from a trusted source.
