Email Authentication · DKIM

DKIM signing and Spam Act 2003 compliance in the Australia

MailMaid Academy · Updated January 15, 2026 · 2 min read DMARC pass

Short answer

The Spam Act requires consent, sender identification, and a functional unsubscribe in every commercial message. DKIM signing supports compliance by making sender identity verifiable and recipient choices enforceable.

What Spam Act 2003 requires#

The Spam Act requires consent, sender identification, and a functional unsubscribe in every commercial message.

What DKIM signing is#

DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.

Why it matters#

DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.

How DKIM signing supports Spam Act 2003 compliance#

Regulators and recipients need to identify who sent a message and trust that opt-out mechanisms work. DKIM signing contributes by dKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.

Implementation steps#

Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
Publish the public key as a TXT record at selector._domainkey.yourdomain.com.
Enable signing in the sending platform and confirm the d= tag in outgoing headers matches your organizational domain.
Send a test to a seed address and inspect the Authentication-Results header for dkim=pass.
Schedule key rotation every 6 to 12 months using a second selector so old mail still verifies.

Example DKIM record

s1._domainkey.example.com.  IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Frequently asked questions#

What is a DKIM selector?

A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.

Why does DKIM pass but DMARC fail?

Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.

Can I use one DKIM key for all my ESPs?

You can publish separate selectors per vendor. Never share private keys between platforms.