[ Quick answer ]
A DKIM signature is the DKIM-Signature header added to an email. It contains the signing domain (d=), selector (s=), algorithm (a=), signed headers (h=), body hash (bh=) and the signature itself (b=).
Key facts
- ›d= must align with the From domain for DMARC.
- ›bh= is a hash of the body; any change after signing breaks it.
- ›Forwarding usually preserves DKIM, unlike SPF.
Reviewed 2026-11-02 · EmailAuth research team
A DKIM-Signature is a header your sending server adds to each message. It carries a cryptographic signature over the message body and a chosen set of headers, plus the information a receiver needs to verify it: which domain signed the mail, which selector holds the public key, and which algorithm was used. The receiver reads this header, fetches your public key from DNS, and confirms the signature. A pass means the mail was authorized by your domain and was not altered in transit.
The tags inside a DKIM-Signature
The header is a set of tag=value pairs separated by semicolons. Each tag tells the receiver something it needs to verify the message. The most important ones are these.
- v: the DKIM version, currently 1.
- a: the signing algorithm, for example rsa-sha256.
- d: the signing domain, the domain that takes responsibility for the message.
- s: the selector, which points to the public key in DNS.
- bh: the hash of the message body.
- b: the actual cryptographic signature over the headers and body hash.
- h: the list of header fields that were signed, such as from:subject:date:to.
Example DKIM-Signature header
v=1; a=rsa-sha256; d=example.com; s=s1; h=from:subject:date:to; bh=frcCV1k9oG9...; b=dzdVyOfAKCdLXd...
How verification works
When a message arrives, the receiver reads the d= domain and the s= selector, then looks up the public key at s._domainkey.d, for example s1._domainkey.example.com. It recomputes the body hash and compares it to the bh tag, then uses the public key to check the b signature against the signed headers listed in h. If both match, DKIM passes. If the body or any signed header changed after sending, the hashes differ and verification fails, which is how DKIM catches tampering.
The role of the h and bh tags
The bh tag is a hash of the body, so any change to the message content breaks it. The h tag lists which headers are protected, and the b signature covers exactly those headers. Signing From is essential, since that is the address recipients see. Signers often leave the body hash tolerant of trailing whitespace so ordinary mail handling does not break the signature, while still catching real edits.
Signature, alignment, and DMARC
A valid DKIM signature is necessary but not sufficient for DMARC. DMARC also checks that the d= domain aligns with your visible From domain. When they match, DKIM is aligned and can satisfy DMARC on its own. SPF provides a second alignment path. Because the DKIM signature travels with the message, it often survives forwarding where SPF breaks, which makes DKIM alignment valuable for reaching the inbox.
Watching your signatures over time
Signatures can quietly break when a vendor changes signing, a selector is retired, or a key goes stale. EmailAuth reads the DKIM-Signature on real mail, monitors your selectors, and flags weak or expired keys before receivers reject your messages. A free domain scan reports your active selectors, key strength, and whether DKIM aligns for DMARC, so you can confirm every signing path is healthy.
Frequently asked questions
What does the b tag in a DKIM-Signature mean?
The b tag holds the actual cryptographic signature, computed over the signed headers and the body hash using your private key. The receiver verifies it with the public key from DNS. If the b value does not check out, DKIM fails and the message is treated as unsigned or suspect.
What is the difference between the bh and b tags?
The bh tag is a hash of just the message body, so any change to the content breaks it. The b tag is the signature over the selected headers plus that body hash. A receiver checks bh first, then verifies b, and both must pass for DKIM to succeed.
Which headers does DKIM sign?
The h tag lists the signed headers, commonly From, Subject, Date, and To, though the exact set is chosen by the signer. From is the most important because it is the address recipients see. Any change to a signed header after sending will break verification.
Why does DKIM sometimes still pass after forwarding?
The DKIM-Signature travels inside the message, so a forwarded email keeps its signature even when the sending IP changes. As long as the signed body and headers stay intact, verification still passes. This is why DKIM survives forwarding better than SPF, which breaks when the sending server changes.
Why does DKIM fail?
Common causes are a missing or mistyped public key, a selector mismatch, or a mailing list or security gateway changing the message after it was signed.
[ DKIM guide ]
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.