Email Verification: DKIM and DomainKeys

How do you verify an email?  The from address can be easily spoofed and contents could have be tampered with.  Well, there's a system that's been around for a few years now and if you're a GMail or Yahoo! Mail user you may be surprised to learn that your emails are digitally signed and this signature can be used to validate the email contents and it's sender.

Take a look in the headers of a received email (View->Headers->All or similar in your email client).  If you see one of of the following:

DKIM-Signature
DomainKey-Signature

then your email has been digitally signed.  Note you won't necessarily see these headers if you send an email to yourself or recieve it from within the same domain as the mail server will often be configured not to add these headers for local mail.

DomainKeys was originally invented by Yahoo! to combat spam, but clearly DKIM and DomainKeys are useful wherever email authentication is desired.

How does it work?  Very simply, the body of the email message is formatted and any email headers of interest (such as  message-id, subject, date, to, from headers) concatentated.  A hash of this text is taken and then encrypted using public key encryption to produce a digital signature of the email. This work is done by the ISP mail server (only they know the private key).  The public key is available in their DNS records (as a TXT record) and is used by the mail client to authenticate the email.

This means you can verify the contents and the sender of the email.  As the message body has been hashed you can confirm the contents of the email are true, but you cannot use it to, say, construct the original contents of an email that has been tampered with.

I wrote a java program to verify emails I've been previously sent and were stored in a pst.  I found the JPST library useful for manipulating pst files and Chilkat for DomainKey work.  More recently I've seen java-libpst but not had time to try it out yet.

I've found problems with psts and multipart messages - MS has a habit of reformatting a multipart email body and hence the DomainKey authentication can fail.

I've also had issues with anti-virus programs adding signatures to received email.  Either stop your virus checker doing this, run email authentication before the anti-virus or remove the anti-virus signature before email authentication.

DomainKeys RFC4870

DKIM RFC4871