What is the Difference Between DomainKeys and DKIM?
Both these terms sound alike, so some people get confused and use them interchangeably. However, doing so isn’t right. DKIM, which stands for DomainKeys Identified Mail, is a successor to Yahoo’s DomainKey or DK.
To understand this better, we’ll have to rewind a little to the past.
In the early 2000s, industry experts recognized the need to improve email security to combat email-based frauds and spam while fostering trust and reliability in email communication. To achieve this goal, a proposal was made in 2004 to combine Yahoo’s DomainKeys and Cisco’s Identified Internet Mail (IIM) to form the DKIM standard.
While the protocols serve similar purposes, they have some key differences. DomainKeys is now obsolete and has been replaced by DKIM.
What is DomainKeys?
DomainKeys is a deprecated email authentication protocol developed by Yahoo. It worked by adding a digital signature to the email message header using public-key cryptography. This signature was generated using a private key that corresponded to a public key stored in the openly accessible DNS records of the sender.
What is DomainKeys Identified Mail or DKIM?
DKIM also resolves the same purpose but uses an open standard, making it simpler for email service providers to interpret and interoperate efficiently. DKIM also attaches a digital signature to the email header using public key cryptography.
Image sourced from helpnetsecurity.com
The Key Differences
Both technologies had similar objectives of verifying the senders’ authenticity but involved different approaches and implementations. By merging these technologies, the developers could leverage the strengths of each approach and create a more comprehensive solution. So, let’s see what differences they have.
1. History and Development
DomainKeys
It was created by Yahoo in 2004 in collaboration with Cisco and was one of the earliest attempts to secure email through sender authentication.
DKIM
DKIM was the successor and evolved version of DomainKeys, which was developed by a consortium of tech giants, including Yahoo, Cisco, Microsoft, etc. It was made public in 2007.
2. Keys
DomainKeys
This method involved the use of a single private key that the sender uses to add a digital signature to an outgoing email. The corresponding public key was published in the DNS records of the sending domain.
DKIM
DKIM uses a pair of keys – a private key for signing outgoing emails and a public key published in the DNS records of the sending domain.
3. Signature Placement
DomainKeys
The digital signature was added to the entire message body and selected headers.
DKIM
DKIM offers the flexibility in selecting which parts of an email to sign. It can sign specific headers, the body, or both.
4. Compatibility
DomainKeys
DomainKeys had limited adoption and is largely deprecated in favor of DKIM.
DKIM
DKIM is widely adopted and supported by major email providers and servers, becoming the de facto standard for email authentication.
5. Security Features
DomainKeys
DomainKeys prevented email-based spamming, spoofing, and phishing attempts.
DKIM
In addition to preventing email-based spamming, spoofing, and phishing attempts, DKIM has the ability to include a hash of the message body in the signature. This allows verification of the integrity of the email’s content.
SPF, DKIM, and DMARC combat email-based menaces and largely compensate for each other’s shortcomings, becoming a wholesome combination.