{"id":1008,"date":"2012-12-02T18:05:02","date_gmt":"2012-12-02T16:05:02","guid":{"rendered":"http:\/\/www.limilabs.com\/blog\/?p=1008"},"modified":"2014-05-28T10:40:45","modified_gmt":"2014-05-28T08:40:45","slug":"sign-emails-with-dkim","status":"publish","type":"post","link":"https:\/\/www.limilabs.com\/blog\/sign-emails-with-dkim","title":{"rendered":"Sign emails with DKIM"},"content":{"rendered":"

DKIM is short for DomainKeys Identified Mail. It is a method for associating a domain name to an email message. It allows a person, role, or organization (domain owner) to claim some responsibility for the message<\/strong>. <\/p>\n

DKIM adds a digital signature to the email message headers (using DKIM-Signature field), which can be validated by recipients. Signer also puts his\/hers public key in the TXT DNS record. The verifier recovers the signer’s public key from the specified DNS<\/strong> record, and then verifies that the signature matches the message’s content<\/strong>.<\/p>\n

Usually DKIM signature covers several most important message headers (From:, Subject:) and the message body.<\/p>\n

The DKIM-Signature header field apart from the actual signature signature contains the domain name, the list of covered header fields, the signing algorithm, and the method by which text snippets are simplified for signing purposes (canonicalization). <\/p>\n

Create private\/public key for DKIM<\/h2>\n

The easiest way to generate public and private key for DKIM purposes is to use OpenSSL. The output is already Base64 encoded and ready to be used when createing DNS record and signing an email.<\/p>\n

To create a private key<\/strong>:
\nopenssl genrsa -out private.key 1024<\/code><\/p>\n

To create a public key<\/strong> using the private key:
\nopenssl rsa -in private.key -pubout -out public.key<\/code><\/p>\n

Full listing follows:<\/p>\n


\nc:\\>openssl genrsa -out dkim_private.key 1024<\/p>\n

Loading 'screen' into random state - done
\nGenerating RSA private key, 1024 bit long modulus
\n...++++++
\n..++++++
\ne is 65537 (0x10001)<\/p>\n

c:\\>openssl rsa -in dkim_private.key -pubout -out dkim_public.key
\nwriting RSA key<\/p>\n

c:\\>
\n<\/code><\/p>\n

Create DNS record for DKIM<\/h2>\n

Copy your public key from dkim_public.key file. Copy everything between “—–BEGIN PUBLIC KEY—–” and “—–END PUBLIC KEY—–” and remove new lines:<\/p>\n


\n-----BEGIN PUBLIC KEY-----
\nMIG...AQAB
\n-----END PUBLIC KEY-----
\n<\/code><\/p>\n

Simplest DKIM DNS record has following format:<\/p>\n

\"v=DKIM1; p=MIG...AQAB; t=s\"<\/code><\/p>\n