How do I implement DomainKeys and is it still a relevant email authentication method?

Summary

The comprehensive feedback from experts, marketers, and documentation sources strongly advises against implementing DomainKeys. DomainKeys is considered obsolete, superseded by DKIM (DomainKeys Identified Mail), and not a relevant email authentication method for modern email systems. While technical resources for DomainKeys implementation exist, the consensus is to focus on DKIM, SPF, and DMARC to improve deliverability, prevent spoofing, and protect brand reputation. Major email providers do not check for DomainKeys, and it's not integrated with DMARC. Therefore, implementing DomainKeys is not worth the effort.

Key findings

  • DomainKeys Obsolete: DomainKeys is an outdated and obsolete email authentication method.
  • DKIM Supersedes: DKIM (DomainKeys Identified Mail) has superseded DomainKeys.
  • Not Generally Checked: Major email providers like Yahoo and Google do not typically check for DomainKeys.
  • Modern Alternatives: Modern email authentication methods include DKIM, SPF, and DMARC.
  • Prevents Spoofing: DKIM helps prevent email spoofing and phishing attacks.

Key considerations

  • Do Not Implement: Do not implement DomainKeys for email authentication.
  • Focus on DKIM: Focus on implementing DKIM for better email deliverability and security.
  • Implement SPF and DMARC: Implement SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting & Conformance) for enhanced email authentication.
  • Update Authentication: Update your email authentication methods to ensure compatibility with modern email systems.

What email marketers say
8Marketer opinions

The consensus from various email marketers and technical communities is that DomainKeys is an outdated email authentication method superseded by DKIM (DomainKeys Identified Mail). Implementing DomainKeys is generally not recommended, as major email providers like Yahoo and Google primarily focus on DKIM, SPF, and DMARC for email authentication. Modern email systems provide better security and compatibility when leveraging DKIM instead. DKIM works by adding a digital signature verified using DNS records, protecting against spoofing and enhancing deliverability.

Key opinions

  • DomainKeys Obsolete: DomainKeys has been largely replaced by DKIM and is considered outdated.
  • DKIM is Standard: DKIM is the current standard for email authentication, offering better security and compatibility.
  • Yahoo and Google Focus: Major email providers primarily check for DKIM, SPF, and DMARC.
  • Prevents Spoofing: DKIM helps prevent email spoofing and phishing attacks.
  • Improves Deliverability: Implementing DKIM improves email deliverability and protects domain reputation.

Key considerations

  • Implement DKIM: Focus on implementing DKIM instead of DomainKeys for modern email authentication.
  • Check DNS Records: Ensure that DKIM signatures are correctly verified using public keys in your domain's DNS records.
  • Use Modern Methods: Prioritize SPF, DKIM, and DMARC for a comprehensive email authentication strategy.
  • DMARC consideration: Implement DMARC to define how email receivers should handle messages that fail authentication checks.
Marketer view

Email marketer from Reddit comments that implementing DomainKeys isn't worth the effort because it's outdated. Instead, focus on SPF, DKIM, and DMARC for modern email authentication.

April 2021 - Reddit
Marketer view

Email marketer from ServerFault advises that DomainKeys is old and you should use DKIM instead. It provides better security and compatibility with modern email systems.

May 2022 - ServerFault
Marketer view

Email marketer from EmailDrip explains DKIM helps prevent email spoofing and phishing attacks by verifying the sender's identity. This improves email deliverability and protects your domain's reputation.

August 2022 - EmailDrip
Marketer view

Email marketer from MXToolbox mentions that DomainKeys is an older email authentication method largely replaced by DKIM. It's generally not necessary to implement it for modern email deliverability.

October 2021 - MXToolbox
Marketer view

Email marketer from Postmark says that DKIM works by adding a digital signature to the header of your email messages. This signature is then verified by the recipient's email server using a public key published in your domain's DNS records. If the signature is valid, the recipient server can be confident that the message has not been tampered with and that it truly originated from your domain.

July 2023 - Postmark
Marketer view

Email marketer from StackOverflow shares that DKIM is the standard now and DomainKeys has been deprecated. Focus on setting up DKIM properly.

February 2025 - StackOverflow
Marketer view

Marketer from Email Geeks clarifies that even if a message is signed with DomainKeys, Yahoo and Google do not necessarily check for it, and this would be reflected in the authentication results.

January 2023 - Email Geeks
Marketer view

Email marketer from Email Geeks explains that Yahoo implemented DomainKeys before it was vetted by the IETF group, which is why it didn't gain much traction, drawing parallels with MS's attempt to implement SPF2.0. He also shared a link to interesting reading material on how SPF, DKIM, and DMARC were developed.

February 2024 - Email Geeks

What the experts say
5Expert opinions

Experts in email deliverability and authentication overwhelmingly advise against implementing DomainKeys. The consensus is that DomainKeys is obsolete, largely merged into DKIM, and formally superseded by DKIM standards (RFC 4871). While technical documentation (RFC 4870) exists for DomainKeys implementation, it requires software development and cryptography knowledge, which is not recommended. Instead, experts strongly suggest focusing on modern authentication methods like DKIM, SPF, and DMARC to ensure deliverability and protect brand reputation, as SPF alone is insufficient.

Key opinions

  • DomainKeys Obsolete: DomainKeys is considered obsolete and not a current best practice.
  • Merged into DKIM: DomainKeys functionality has largely been merged into DKIM.
  • RFC 4871 Supersedes: RFC 4871 (DKIM) formally obsoletes RFC 4870 (DomainKeys).
  • Focus on DKIM/DMARC: Experts recommend implementing DKIM and DMARC for optimal deliverability.
  • SPF Insufficient: SPF alone is not sufficient for robust email authentication.

Key considerations

  • Avoid DomainKeys: Do not invest time or resources in implementing DomainKeys.
  • Implement DKIM/DMARC: Prioritize implementing DKIM and DMARC for modern authentication.
  • Update Authentication: Ensure your email authentication methods are up-to-date to protect deliverability and brand reputation.
Expert view

Expert from Email Geeks shares that RFC4870 provides the information needed to implement DomainKeys, requiring software development and cryptography libraries.

February 2022 - Email Geeks
Expert view

Expert from Email Geeks explains that the current best practice for DomainKeys is to not use it, as it is obsolete and largely merged into DKIM.

December 2021 - Email Geeks
Expert view

Expert from Spam Resource emphasizes the importance of email authentication (SPF, DKIM, DMARC) for deliverability and brand protection. While it doesn't explicitly say DomainKeys is deprecated, the focus on modern methods makes it clear that those are the methods to use to secure your brand.

April 2024 - Spam Resource
Expert view

Expert from Email Geeks notes that RFC 4870 was published alongside RFC 4871 (the first DKIM RFC) and was formally obsoleted by it.

May 2023 - Email Geeks
Expert view

Expert from Word to the Wise strongly recommends implementing DKIM and DMARC, stating that SPF alone is insufficient and can cause deliverability problems if not configured correctly. DomainKeys is not mentioned, implying it is not relevant.

January 2023 - Word to the Wise

What the documentation says
4Technical articles

Email authentication documentation from IETF, SourceForge, and Valimail indicate that DomainKeys is obsolete and has been superseded by DKIM (DomainKeys Identified Mail). While resources exist for implementing DomainKeys, the documentation emphasizes the importance of DKIM and modern authentication methods like SPF and DMARC, with no mention of DomainKeys in relation to DMARC configuration. DKIM and DMARC are the recommended methods for ensuring message authenticity and integrity.

Key findings

  • DomainKeys Obsolete: DomainKeys is an obsolete email authentication method.
  • DKIM Supersedes: DKIM (RFC 4871) obsoletes the original DomainKeys specification.
  • Focus on DKIM/SPF/DMARC: Modern email authentication strategies should prioritize DKIM, SPF, and DMARC.
  • DMARC Integration: DomainKeys is not relevant to DMARC configuration.

Key considerations

  • Avoid DomainKeys: Avoid implementing DomainKeys.
  • Implement DKIM: Implement DKIM for email authentication.
  • Configure SPF/DMARC: Configure SPF and DMARC for enhanced email security and deliverability.
Technical article

Documentation from Valimail recommends publishing a DMARC record, setting up SPF and DKIM to ensure better authentication. DomainKeys are not even mentioned in relation to DMARC.

January 2024 - Valimail
Technical article

Documentation from IETF explains that DomainKeys Identified Mail (DKIM) defines a mechanism by which email message senders can digitally sign their messages, providing a means for recipient systems to verify the authenticity and integrity of the message. Although this document specifies DomainKeys, it has been obsoleted by RFC 4871 which specify DKIM.

August 2022 - IETF (RFC 4870)
Technical article

Documentation from IETF explains that DomainKeys Identified Mail (DKIM) defines a mechanism by which email message senders can digitally sign their messages, providing a means for recipient systems to verify the authenticity and integrity of the message. This specification obsoletes the original DomainKeys specification.

June 2021 - IETF (RFC 4871)
Technical article

Documentation from SourceForge provides resources and tools for implementing DomainKeys, including software packages and documentation, although it's essential to note that DomainKeys is largely superseded by DKIM.

November 2024 - SourceForge