What’s the Difference Between DKIM and DMARC?

DMARC VS DKIM

What do DMARC and DKIM stand for?

DMARC is an acronym for Domain-based Message Authentication Reporting and Conformance. It is a protocol that uses SPF and/or DKIM records to authenticate emails. It also allows you to monitor and control what happens to unauthenticated emails sent from your domain.

DKIM is an acronym for DomainKeys Identified Mail. It is a method of verifying the authenticity of emails using cryptographic authentication.

How does DMARC work?

To begin with, the basic function of DMARC is to determine whether an email should be delivered to its intended recipient. In order to do this, it determines what kind of DNS records are stored for a particular domain. The DMARC record itself contains instructions as to where the email should be sent if it fails either SPF or DKIM checks.

It also provides instructions as to how much of the message should be delivered if it fails authentication. There are three possible options here: 

• "none" means that all failed messages should be treated as normal
• "quarantine" means that some portion of the message should be delivered, but only with a warning
• "reject" means that no part of the message should be delivered at all

How does DKIM work?

The verification is done by adding a digital signature to each message sent from your server. This signature is added by adding a header to the email that contains a few key pieces of information:

• The domain name used to send the email
• A DKIM selector is used to help locate the DKIM public keys in the DNS in case there are multiple DKIM records published
• The public key will be used by the recipient’s mail server to decrypt part of the message and compare it against another part of the message in order to verify that it was sent from an authorized server
• A hash value is generated from parts of the message so that those parts can be verified by anyone who has authorized access.

What’s the Difference Between DKIM and DMARC?

DKIM and DMARC do very different things that complement each other in the closed echo chamber of a single domain. While it’s true that both DKIM and DMARC rely on the use of cryptographic keys to authenticate legitimate senders, that’s where all similarities stop. Here are some of the key differences between DKIM vs. DMARC:

• DMARC generates a report each time a message fails authentication.
• DMARC, you see when a receiving server verifies your domain and marks the message as legitimate on each report
• DKIM uses digital signatures to verify legitimate senders. 
• DKIM is solely an authentication method, while DMARC generates aggregate reports to help fine tune your email strategy.
• DKIM allows receiving servers to verify the digital signature on all your emails. 

Can DKIM Function Without DMARC?

The short answer is yes. With DKIM, your email server applies a digital signature to all outgoing messages, proving that your emails originate from you. The receiving server verifies the digital signature using the matching public key in your DKIM record.

DKIM allows you to sign every email you send digitally. This identifier won’t be present on fraudulent emails. If a malicious sender spoofs your domain in a fake email, the receiving server will reject it (since it won’t have a valid DKIM signature).

Source:

DMARC VS DKIM | Which is better for you and why? (powerdmarc.com)

DKIM vs. DMARC | EasyDMARC