iCloud Mail applies Mail Privacy Protection, which inflates open rates and hides recipient IPs, so engagement metrics need re-baselining.
What DKIM signing is#
DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.
Why it matters#
DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.
Setting up DKIM signing for Apple iCloud Mail#
- Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
- Publish the public key as a TXT record at selector._domainkey.yourdomain.com.
- Enable signing in the sending platform and confirm the d= tag in outgoing headers matches your organizational domain.
- Send a test to a seed address and inspect the Authentication-Results header for dkim=pass.
- Schedule key rotation every 6 to 12 months using a second selector so old mail still verifies.
s1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."How Apple iCloud Mail reports results#
Open a delivered test message in Apple iCloud Mail and view the original or headers. Look for Authentication-Results and any provider-specific verdict headers. Use the provider's sender dashboard for aggregate reputation.
Common mistakes#
- Signing with the ESP's domain (d=esp.com) instead of yours, which passes DKIM but fails DMARC alignment.
- Copying the public key with line breaks or quotes broken, producing a permanent verification failure.
- Modifying message bodies after signing (footers injected by gateways) which invalidates the signature.
- Never rotating keys, leaving a compromised key valid indefinitely.
Frequently asked questions#
What is a DKIM selector?
A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.
Why does DKIM pass but DMARC fail?
Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.
Can I use one DKIM key for all my ESPs?
You can publish separate selectors per vendor. Never share private keys between platforms.
Does Apple iCloud Mail require DKIM signing?
iCloud Mail applies Mail Privacy Protection, which inflates open rates and hides recipient IPs, so engagement metrics need re-baselining. Treat DKIM signing as required for any meaningful volume.