Skip to main content

Back to Songbook

DKIM on My Mind

Listen on

Spotify Deezer Apple Music

DKIM on My Mind

An original song by Inbox Senders Club

AlbumInbox on the LineTrack 4

A weary sender's blues meditation on DKIM authentication — the loneliness of unsigned headers, the heartbreak of broken signatures, and the hard-won wisdom of key rotation, selector hygiene, and domain alignment across multiple vendors. Sung from the perspective of someone who's watched messages fail trust checks one too many times and learned that without a valid signature, nothing else matters.

Authentication Security

6:27

Duration

Verse

Got my name on every message, but they still ask who I am

Says I sent it from my house, but the proof don’t always land

Headers tell a long story, every hop every line

If I don’t sign what I’m sending, they won’t trust a word of mine

Chorus

Got DKIM on my mind, yeah I sign every time

Private key in the shadows, public truth on the line

If that signature breaks, if it don’t align

I won’t make it to the inbox, got DKIM on my mind

Verse

I seen keys left too short, seen selectors out of date

Rotated without warning, learned that lesson way too late

One vendor signs today, another one tomorrow night

Different domains in the mix, yeah that trust gets real tight

Chorus

Got DKIM on my mind, gotta keep it consistent

Same domain, same rhythm, gotta stay persistent

If the From don’t match the sign, filters start to decline

I won’t make it to the inbox, got DKIM on my mind

Bridge

2048 bits of mercy, don’t cut corners on the key

One break in the chain, and they stop believing me

Test before I play it loud, every change every time

‘Cause a silent misconfig sings louder than a lie

Verse

ESP swapped the backend, nobody told the band

Old selector still published, but it don’t understand

Some mail unsigned, some mail signed wrong

Reputation slipping while the volume stays strong

Chorus

Got DKIM on my mind, yeah I learned it the hard way

Sign every stream you send, every night and every day

Authentication ain’t magic, it’s just proving you’re kind

And you don’t earn that trust without DKIM on your mind

Outro

So I check my records steady, keep my keys clean and true

Same domain, clear alignment, that’s the work I gotta do

‘Cause filters don’t hear promises, they read every line

I stay singing for the inbox, with DKIM on my mind

Deliverability Case Study: "DKIM on My Mind"

This song is the sound of a sender who has been burned before. The narrator isn't bragging about authentication — they're confessing to the slow, patient work of earning trust through cryptographic proof. DKIM (DomainKeys Identified Mail, RFC 6376) isn't a spell you cast once. It's a discipline you practice every day, and this blues captures the weariness of someone who learned that lesson the hard way.

Here is the technical breakdown of the authentication wisdom buried in these verses:

Verse 1 & Chorus: The Signature That Speaks for You

"Says I sent it from my house, but the proof don't always land / ... / Private key in the shadows, public truth on the line"

The Deliverability Context: DKIM works on asymmetric cryptography. The sender holds a private key kept secret on the signing MTA, and publishes the corresponding public key as a DNS TXT record at selector._domainkey.yourdomain.com. When mail goes out, the MTA hashes selected headers and the body, then signs that hash. The receiver fetches the public key from DNS and verifies the signature. That's the "private key in the shadows, public truth on the line" — a perfect description of the trust model.
The Hard Truth: A From header alone proves nothing. Without a valid DKIM signature aligned to the From domain, you're just a voice claiming a name. Receivers like Gmail and Yahoo — especially since the February 2024 bulk sender requirements — won't take that claim at face value.
The Fix: Sign every message, on every stream, with a d= value that aligns with your From domain so DMARC can pass on the DKIM side.

Verse 2 & Second Chorus: Keys, Selectors, and the Cost of Neglect

"I seen keys left too short, seen selectors out of date / Rotated without warning, learned that lesson way too late / One vendor signs today, another one tomorrow night"

The Reality of Weak Keys: 1024-bit keys are no longer considered safe. M3AAWG and every serious mailbox provider recommend 2048-bit RSA keys at minimum. The bridge's "2048 bits of mercy" isn't poetic license — it's the actual industry floor.
The Lesson on Selectors: Selectors exist precisely so you can rotate keys without downtime. Best practice is to publish a new selector (e.g., s2024b._domainkey), let mail flow under both for a transition window, then retire the old one. Rotating "without warning" — pulling the DNS record before the new key is signing — breaks every message in flight.

Multi-vendor sending:* When one ESP signs with d=esp1.com and another with d=esp2.com, neither aligns with your brand From domain. The fix is per-vendor CNAME delegation so each provider signs as a subdomain of your own domain.

Bridge: Test Before You Play It Loud

"Test before I play it loud, every change every time / 'Cause a silent misconfig sings louder than a lie"

The Hard Truth: DKIM fails quietly. Unlike a bounce, a broken signature doesn't shout — it just slowly erodes your domain reputation while volume keeps climbing. Tools like opendkim-testmsg, Mail-Tester, and DMARC aggregate (rua) reports are how you listen for that silence.
The Lesson: Every backend change — new ESP, new relay, new key, new selector — demands a verification pass before production volume resumes. DMARC reports will tell you which sources are signing correctly and which are unauthenticated, but only if you're reading them.

Verse 3: The Vendor Swap Disaster

"ESP swapped the backend, nobody told the band / Old selector still published, but it don't understand / Some mail unsigned, some mail signed wrong"

The Deliverability Context: This is one of the most common authentication failures in the wild. A platform migration happens, the new infrastructure signs with a different selector — or doesn't sign at all — and the old DNS records sit there pointing to nothing useful. Receivers see partial alignment, intermittent failures, and a sender that looks unstable.
The Fix: Treat authentication as part of the change-management checklist. Publish new selectors before the cutover, monitor DMARC rua reports during and after, and only retire old DNS entries once aggregate data confirms zero traffic on the old path.

The narrator's wisdom is the wisdom of every sender who has watched a campaign drift quietly into the spam folder while everything looked fine. Authentication isn't a badge you wear — it's a signature you renew, a key you guard, a record you check at midnight when the volume is high and the margin for error is thin. The inbox doesn't remember what you promised. It only reads what you signed.

Credits

Song: “DKIM on My Mind” — Inbox Senders Club

Songwriter: Inbox Senders Club

Producer: Inbox Senders Club

© Inbox Senders Club. All rights reserved.