Next: Appendix 4 Up: Network Liaison's Handbook Previous: Appendix: Sender Policy Framework (SPF)

Appendix: DomainKeys Identified Mail (DKIM)

DomainKeys Identified Mail (DKIM) is a DNS-based mechansim for cryptographically authenticating email messages. Messages are signed by the mail exchanger with a private key, and the public key is published in a DNS TXT record associated with the sending host. RFC 6376 describes the record format and validation strategies. When combined with Domain-based Message Authentication, Reporting, and Conformance (DMARC) from RFC 7489, and SPF (as described in the prior appendix, it can be used to authenticate allowed email senders from a domain.

DMARC records are controlled at a VT-wide level. If you have hosts sending from @vt.edu email addresses, DKIM is important for ensuring delivery to some 3rd party mail services. There are 2 pieces to correctly configure: a TXT record with your public key, and the "domain" and "selector" used to find that key (and which specify what name is on the TXT record).

We currently have no automated process with which to add TXT records to the VT DNS servers. Instead, NLs must email the hostmaster to request a manual record entry.

Recomended Selector and Domain

In order to send as @vt.edu with DMARC, the "domain" part of a DKIM record must be "aligned" with the FROM header domain. i.e., if you send as @vt.edu the "domain" part must be d=vt.edu in DKIM signatures. If you send from @cns.vt.edu you would sign with d=cns.vt.edu.

The "selector" component tells the system validating the signature where to look for the public key. For a message with d=vt.edu; s=k1.cannondale.cns; the public key will be located at

k1.cannondale.cns._domainkey.vt.edu. IN TXT ...

We require that the selector end with a departmental subdomain (e.g. cns or math) if the domain value is d=vt.edu. We recommend that departments use hostnames or service names as prefixes, and recommend adding a key identifier (k1 in the above example) to further distinguish between keys, as they may rotate from time to time.

External Records

External services may ask that the DKIM record be a CNAME record (i.e. an alias). This is allowed provided it follows the above rules. e.g.

k1.servicenow.cns._domainkey.vt.edu. IN CNAME ...

If the vendor cannot accomodate such selectors, it will require a special approval process. We recommend that you instead send from your subdomain, and put the DKIM key there:

vendorselector._domainkey.cns.vt.edu. IN CNAME ...

If you have questions about these guidelines, please reach out to CCS or the hostmaster.

Next: Appendix 4 Up: Network Liaison's Handbook Previous: Appendix: Sender Policy Framework (SPF)

Eric C. Landgraf 2025-10-07