Signing domain and selector
01The signature identifies a signing domain and a selector for its DNS public key.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.5 ↗
RFC 6376 · § 3.5EXAMPLE
3 / 3
03
Publish verification data
The corresponding DNS public key enables receivers to check it.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 6376 original algorithm choicesRFC 8301 §3.1
The update prohibits rsa-sha1 signing and verification and requires rsa-sha256 support in that RSA design; RFC 8463 separately adds Ed25519.
Read the updated RFC section ↗d= names the signing domain; s= selects a key below _domainkey.
- d= names the signing domain; s= selects a key below _domainkey.
- DKIM proves a signing-domain responsibility assertion, not the author’s personal identity.
- The signature is visible and does not encrypt the message.
Examples are illustrative. Consult the linked RFC and its errata for implementation details.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy