---
title: "Understanding DKIM: syntax, tags, and email | DMARC Report"
description: "Understanding DKIM: syntax, tags, and email from DMARC Report explains practical steps for email authentication, domain protection, deliverability, and DMARC."
image: "https://dmarcreport.com/og/blog/understanding-dkim-syntax-tags-and-email.png"
canonical: "https://dmarcreport.com/blog/understanding-dkim-syntax-tags-and-email/"
---

Quick Answer

DKIM (RFC 6376) signs email messages cryptographically, and unlike SPF, the signature survives email forwarding - which is why DMARC alignment via DKIM is more reliable than SPF alignment for forwarded mail. Understanding DKIM: syntax, tags, and email Understanding DKIM: syntax, tags, and email

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Funderstanding-dkim-syntax-tags-and-email%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Understanding%20DKIM%3A%20syntax%2C%20tags%2C%20and%20email&url=undefined%2Fblog%2Funderstanding-dkim-syntax-tags-and-email%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Funderstanding-dkim-syntax-tags-and-email%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Funderstanding-dkim-syntax-tags-and-email%2F&title=Understanding%20DKIM%3A%20syntax%2C%20tags%2C%20and%20email "Share on Reddit") [ ](mailto:?subject=Understanding%20DKIM%3A%20syntax%2C%20tags%2C%20and%20email&body=Check out this article: undefined%2Fblog%2Funderstanding-dkim-syntax-tags-and-email%2F "Share via Email") 

![Understanding DKIM: syntax, tags, and email](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 

## Try Our Free DKIM Lookup

Auto-discover DKIM selectors for any domain - scan 185 common selectors across all major providers.

[ Discover DKIM Selectors → ](/tools/dkim-lookup/) 

![Dmarc report 8 150x150](https://media.mailhop.org/dmarcreport/images/2024/07/dmarc-report-8-150x150.jpg) 

DKIM ([RFC 6376](https://datatracker.ietf.org/doc/html/rfc6376)) signs email messages cryptographically, and unlike SPF, the signature survives email forwarding - which is why DMARC alignment via DKIM is more reliable than SPF alignment for forwarded mail.

> DKIM is the authentication protocol that survives email forwarding, says Brad Slavin, General Manager of DuoCircle. When SPF fails because a forwarder’s IP isn’t in the original record, DKIM alignment is the only path to DMARC pass. That’s why we monitor DKIM alongside SPF in every DMARC Report dashboard.

```
					DMARC Report					

				
```

Understanding DKIM: syntax, tags, and email

```
					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						
```

Play Episode

```
					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						
```

Pause Episode

```
					</button>
				

					<audio preload="none" class="clip clip-14486">
						<source src="https://media.mailhop.org/dmarcreport/images/2024/07/Understanding-DKIM-syntax-tags-and-email.mp3">
					</audio>
						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								
```

Mute/Unmute Episode

```
							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								
```

Rewind 10 Seconds

```
							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								
```

Fast Forward 30 seconds

```
							</button>
						

							<time class="ssp-timer">00:00</time>
							
```

/

```
							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H1M59S">1:59</time>
			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-14486" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-14486" title="Share">Share</button>
										</nav>

						
```

RSS Feed

```
							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-14486" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-14486" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

						Share						
					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/understanding-dkim-syntax-tags-and-email/&t=Understanding DKIM: syntax, tags, and email" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/understanding-dkim-syntax-tags-and-email/&url=Understanding DKIM: syntax, tags, and email" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2024/07/Understanding-DKIM-syntax-tags-and-email.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

						Link						
					

						<input value="https://dmarcreport.com/blog/podcast/understanding-dkim-syntax-tags-and-email/" class="input-link input-link-14486" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-14486" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
					

						Embed						

					
```

/\*! This file is auto-generated \*/ ’ title=“Embed Code” class=“input-embed input-embed-14486” readonly/>

```
					<button class="copy-embed copy-embed-14486" title="Copy Embed Code" aria-label="Copy Embed Code"></button>


```

DKIM is a [cryptography-based email authentication protocol](https://dmarcreport.com/blog/the-emergence-of-dkim-a-cryptography-based-email-authentication-protocol/) that allows the receiving server to check whether an email coming from a specific domain is officially **authorized to send emails**. If your domain has DKIM, then whenever you send an email, your server will attach a [digital signature](https://www.techtarget.com/searchsecurity/definition/digital-signature) to the header. _This signature is produced using a private key that is known only to you_.

The counterpart of the [private key](https://www.coinbase.com/learn/crypto-basics/what-is-a-private-key) is a public key that is published in your \*\*domain’s DNS so that any server on the internet can retrieve it for confirmation.

Once the \*\*receiving server receives your email, it retrieves the [public key](https://www.techopedia.com/definition/16139/public-key) to verify its legitimacy and ensure no alterations were made to the message in transit.

## Is DKIM useful?

_DKIM is indeed a useful email authentication protocol that verifies an email’s legitimacy_. It protects against [phishing and spoofing](https://www.justice.gov/usao-ndtx/pr/nigerian-man-pleads-guilty-real-estate-phishing-spoofing-scheme), which could otherwise leave negative **financial and reputational footprints**.

You know what’s an added advantage over and above email authentication? Well, DKIM helps enhance your [sender’s reputation](https://sendpulse.com/support/glossary/sender-reputation), which means mailboxes regard you as a **genuine sender**. Thus, most of your emails will land in the desired recipients’ inboxes instead of [spam folders](https://www.foxnews.com/tech/big-bucks-hiding-spam-folder).

Deploying DKIM also helps your company comply with [email security](https://dmarcreport.com/) **policies and standards**, keeping you away from litigation.

![Dmarc analyzer](https://media.mailhop.org/dmarcreport/images/2024/07/dmarc-analyzer-7897.jpg) 

## DKIM syntax

DKIM publishes the public key and related information using a [DNS TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/). The syntax of a [DKIM record](https://www.hostinger.in/tutorials/dkim-record) includes several tags, each specifying a **particular piece of information**. Here are the most common tags used in DKIM records:

- **v**, _It stands for the version tag, which specifies the DKIM version you are using_. As of now, there is only one **DKIM version**, so its value is always v=DKIM1.
- **a**, This tells the algorithm you used to produce the DKIM signature. Common values are ‘rsa-sha256’ and ‘rsa-sha1.’
- **b**, It’s the actual digital signature of the [email headers](https://proton.me/blog/what-are-email-headers) and body. This is a base64-encoded string generated using the private key.
- **bh**, It’s short for body hash, which is basically the hash of the canonicalized body part of the email. This is a base64 encoded hash value.
- **c**, This tag specifies the \*\*canonicalization algorithms used for the header and body. Common values are ‘simple/simple,’ ‘relaxed/simple,’ and ‘relaxed/relaxed.’
![Dmarc record generator](https://media.mailhop.org/dmarcreport/images/2024/07/dmarc-record-generator-5454.jpg) 
- **d**, This is the domain name of the signing entity. So, if you are the one creating the [DKIM](https://dmarcreport.com/blog/dkim-explained-how-dkim-works-and-why-is-dkim-important-for-organizations/) record, \*\*mention your domain name here. _Please ensure the domain name exactly matches or is a subdomain of the domain used in the ‘From’ header of outgoing emails_.
- **h**, It’s the list of signed header fields separated by colons. Example- h=from:to:subject:date
- **i**, It’s an optional identity of the user or agent on behalf of whom the email is signed. A general example can be- i=[user@eng.example.com](mailto:user@eng.example.com)
- **l**, It’s called the **body length count tag**, which specifies the number of bytes of the body included in the hash.

_All these DKIM tags help you mention important information that allows the receiving server to verify if the emails sent from your domain are genuine_. So, ensure you carefully create a DKIM record. If you need any \*\*assistance related to [email authentication](https://dmarcreport.com/blog/why-email-security-matters-and-how-to-get-it-right/), please [contact us](https://dmarcreport.com/contact/).

## Topics

[ dkim ](/tags/dkim/)[ email security ](/tags/email-security/) 

![Adam Lundrigan](https://media.mailhop.org/dmarcreport/images/authors/adam-lundrigan.jpg) 

[ Adam Lundrigan ](/authors/adam-lundrigan/) 

CTO

CTO of DuoCircle. Leads engineering for DMARC Report and DuoCircle's email security product portfolio.

[LinkedIn Profile →](https://www.linkedin.com/in/adamlundrigan/) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/) [Check Your DMARC Record](/tools/dmarc-checker/) 

## Related Articles

[  Intermediate 8m  Decoding I-Tag DKIM Vulnerability and Its Impact on Email Deliverability and Security  Jun 6, 2024 ](/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/)[  Intermediate 4m  Getting Rid of Common SPF Errors for Email Security and Delivery  Dec 20, 2023 ](/blog/getting-rid-of-common-spf-errors-for-email-security-and-delivery/)[  Intermediate 5m  Improving Email Security With DKIM  Dec 8, 2023 ](/blog/improving-email-security-with-dkim/)[  Intermediate 3m  The Emergence of DKIM: A Cryptography-Based Email Authentication Protocol  Nov 29, 2023 ](/blog/the-emergence-of-dkim-a-cryptography-based-email-authentication-protocol/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Understanding DKIM: syntax, tags, and email","description":"Understanding DKIM: syntax, tags, and email from DMARC Report explains practical steps for email authentication, domain protection, deliverability, and DMARC.","url":"https://dmarcreport.com/blog/understanding-dkim-syntax-tags-and-email/","datePublished":"2024-07-19T10:39:17.000Z","dateModified":"2026-04-16T15:53:43.000Z","dateCreated":"2024-07-19T10:39:17.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/adam-lundrigan/#person","name":"Adam Lundrigan","url":"https://dmarcreport.com/authors/adam-lundrigan/","jobTitle":"CTO","description":"Adam Lundrigan is the Chief Technology Officer of DuoCircle, where he leads engineering across DMARC Report, AutoSPF, and the company's email security portfolio. His technical focus includes DMARC report processing infrastructure, DNS monitoring systems, and the SPF evaluation logic that powers DuoCircle's authentication tools.","image":"https://media.mailhop.org/dmarcreport/images/authors/adam-lundrigan.jpg","knowsAbout":["DMARC Report Processing","DNS Architecture","Email Authentication","SaaS Engineering","DNS Monitoring","Infrastructure Automation"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/adamlundrigan/"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/understanding-dkim-syntax-tags-and-email/"},"articleSection":"intermediate","keywords":"dkim, email security","wordCount":826,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg","caption":"Understanding DKIM: syntax, tags, and email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Understanding DKIM: syntax, tags, and email","item":"https://dmarcreport.com/blog/understanding-dkim-syntax-tags-and-email/"}]}
```