Glossary · Email & infrastructure
DKIM
DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending domain cryptographically sign outgoing email — a public key published in DNS verifies the signature, proving headers and body were not altered in transit.
A sending server computes a hash over selected headers and the message body, signs it with a private key, and attaches the signature as a DKIM-Signature header. The receiving server looks up the corresponding public key at a DNS TXT record — under a selector-specific subdomain of the sending domain — and verifies the signature. A match proves the message genuinely originated from a system holding that domain’s private key and was not modified after signing.
DKIM alone answers "was this message tampered with and does it belong to this domain," not "is this domain allowed to send as this address" — that second question is SPF’s job, and DMARC ties the two together into an enforceable policy. Rotating DKIM keys per domain, rather than sharing one key across many customers on a platform, limits the blast radius if a key is ever compromised.
Ciphera Relay signs every message with a per-domain DKIM key — customers get their own key rather than shared signing infrastructure, which keeps sender reputation isolated per domain.