Glossary
Email authentication
DKIM
DomainKeys Identified Mail — a cryptographic signature over selected headers and the message body, verifiable against a public key published in DNS. It proves a domain took responsibility for the message and that the signed parts were not altered.
Defined in RFC 6376.
Where this appears
The lessons that use this term, and what each is for.
Email Authentication FundamentalsWhat a DKIM signature provesState what a valid DKIM signature establishes, and what it deliberately leaves open.Email Authentication FundamentalsSelectors, and finding the keyLocate a domain’s DKIM public keys when nobody remembers the selector names.Email Authentication FundamentalsAnatomy of a DKIM-Signature headerRead a DKIM-Signature header and say which domain is making the claim and which headers it covers.Email Authentication FundamentalsJudging a key: length, test mode, revocationLook at a published DKIM key and decide whether it should still be in use.DKIM PractitionerThe two hashesSay precisely which bytes of a message a signature commits to, and which it does not.DKIM PractitionerDKIM-Signature, tag by tagRead any DKIM-Signature header and state what each tag contributes to the verification.DKIM PractitionerChoosing what to signPick an h= list that resists tampering without making the signature needlessly brittle.DKIM PractitionerAnatomy of a key recordRead every tag in a DKIM key record and say what each one permits or forbids.DKIM PractitionerKey size and algorithmJudge a key’s strength from the record itself, without decoding it.DKIM PractitionerRevocation, and the empty p=Revoke a key correctly, and recognise a revoked key when you meet one.DKIM PractitionerSelectors are not enumerableExplain why a domain’s DKIM keys cannot be listed, and find the ones in use anyway.DKIM PractitionerWhat rotation is actually forState what rotating a key mitigates, and what it does not.DKIM PractitionerEvery dkim= valueMap each result in Authentication-Results to the stage of verification that produced it.DKIM PractitionerShared keysDetermine whether a vendor signs your mail with a key thousands of other domains also use.DKIM PractitionerGetting d= alignedTake a vendor from signing as themselves to signing as you, and verify it happened.DKIM PractitionerSignature replayExplain how a valid signature is abused after the fact, and what limits the damage.DKIM PractitionerWhat to monitorDefine checks that fail before delivery does, not after.DKIM PractitionerThe day a private key is exposedWork through an exposure in an order that ends the abuse without stopping your own mail.Email Security PractitionerFifteen minutes of public DNSEstablish a domain’s entire published mail posture without any access to it.Email Security PractitionerA sending account that is not yours any moreRespond to a compromised platform account that is sending authenticated mail as you.Email Security PractitionerHolding a vendor to itGet a specific alignment commitment from a sender, or establish on the record that they cannot meet it.Domain Trust ArchitectureWhere each control sitsMap every control you have learned onto the surface it defends.