Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did.

Other than dumb systems liking DKIM just because they're built to use it to help stop spam - is there any reason to use it with OpenPGP from a security point of view?

share|improve this question

2 Answers 2

DKIM and OpenPGP are orthogonal. DKIM proves that a given email really came from the mail server which is specified in one of the Received: headers of the mail. It does not give any guarantee as to the actual human sender; DKIM focuses on the path which the email took. DKIM could be a great tool against some classes of spam, in that mail servers could bo configured to reject all emails which pretend to come from a given domain but do not sport a valid signature proving that they did go through the domain outgoing server (this can thwart domain impersonating spams).

OpenPGP (for signed messages), on the other hand, does not care at all about what servers a given email went through. OpenPGP signatures are about validating the human sender. OpenPGP does nothing against spam. OpenPGP can also add encryption, for data confidentiality, something which DKIM does not offer at all.

Since OpenPGP and DKIM do not offer the same functionalities, and neither does what the other offers, then it can make sense to use both.

share|improve this answer

DKIM only really proves it's from the domain it says it is from. OpenPGP digital signatures can prove from a particular email address anyway (as long as the trust of the public key is valid and the private keys haven't been compromised (same goes for DKIM or any digital signatures based on PKI)), OpenPGP also can show it hasn't been tampered with.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.