---
title: "Missing DKIM Record"
canonical: "https://kb.cynergy.app/space/MD/899416308/Missing%20DKIM%20Record"
format: markdown
---
**Description **

DKIM Records are set to verify the authenticity of the sender and by this protect the organization from spoofed and malicious emails. 

This is done by creating a specific digital signature. 

DKIM signature is the main feature of validation. The signature is a hash created by various components within the message. The sender could use the domain, body of the message, and other parts of the message to create a signature. Combined with a DKIM selector, meaning which part of the recipient’s email server can locate the domain’s public key.

**Hacker's View**

As a hacker, I can check the presence of DKIM using [DKIM records checker](https://mxtoolbox.com/dkim.aspx) to see if my sending domain will be verified.  If there is no DKIM record, this means for me that there is a good chance my crafted spoofed email will pass the email verification and will land in the victim organization employee email.

**Mitigation**

#### Create an entry in the public DNS record

Add the DKIM signature to a TXT record in your DNS record. This is made up of a selector (the name of your record), the version, the key type, and the public key itself.

Anyone receiving an email that claims to be from you can verify the signature on the email with the key from your DNS. A successful verification proves the message hasn’t been tampered with in transit.

Your DNS record should have the host or record name of:

`selector._domainkey.mydomain.com`

and the value:

`v=DKIM1, k-rsa,`

You can check this has been applied using a [DKIM lookup service](http://mxtoolbox.com/dkim.aspx) and your selector. The result should look like this:

`v=DKIM1; k=rsa;`  
`p=MIGfMA0GCSadIb3DQEBgAQUAAfafa4GNADCBiQKBgQCG26OM/bk0vNm/TM2DnOQjPZN252212LGHHjfushjsaudfysuf+DUigzM6h2oJasdasfggMEdNt1S/CWVXW0pUBqafafU0fzdw90+jyqOduh4cCnEk0z0w1w1j4xOYy0FLHhKoeoZJwWQFtwrlhrjxD6jM+sGeeRnbn2rQIDAQAB`

#### Apply DKIM signatures to outbound email

How you achieve this will vary, depending on your email service. DKIM signatures may be applied by your filtering service rather than your email server. Ask your service provider for details.

A DKIM signature should be the last addition to a message before it is released by an email server. Since modifying the email or its headers will change its cryptographic hash, it is necessary for any signatures or standard disclaimers to be applied before it is signed with DKIM.

When using email scanning services on outbound email, ensure they are configured in a way that does not break the DKIM signature (By adding a disclaimer line to the bottom of the email body).

**Cynergy’s View**

DKIM policy provides enhanced protection of security to emails, preventing hackers from getting to the organization's inbox via spoofed emails. 

**Reference**

AWS - [https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim.html](https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dkim.html) 

GCP - [https://support.google.com/a/answer/174124?hl=en](https://support.google.com/a/answer/174124?hl=en) 

Azure - [https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide) 

Cloudflare - [https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/)