What is DKIM?

Definition of DKIM

DomainKeys Identified Mail or DKIM is a standard can help prevent spoofing by adding a digital signature to the header of outgoing messages. This includes using the private domain key to encrypt the outgoing email headers from your domain and adding the public version of the key to the domain's DNS records.

The receiving server can then retrieve the public key to decrypt the headers and verify that the message really comes from your domain and was not altered during the delivery process. G Suite digital signatures meet the DomainKeys Identified Mail (DKIM) standard.

How DKIM works

To add a digital signature to outgoing email, you generate a domain key that G Suite uses to generate a signed email header, which is unique to the domain. You add the public key to the Domain Name System (DNS) record for the domain. The recipient can then verify the source of the email message by taking the public key and using it to confirm your signature.

For even stronger security, you can now generate a 2048 bit domain key instead of a 1024 bit domain key. We recommend creating a stronger 2048 bit key if the registrar supports longer key lengths. If you have a previously generated 1024 bit domain key, it will not be affected by this change.

Application examples