Post-quantum DKIM: what should email teams prioritise now?

TL;DR: Post-quantum risk for DKIM is mainly future forgery, not store-now-decrypt-later exposure, because DKIM authenticates email rather than encrypting content, according to Red Sift. The harder problem is interoperable migration across DNS, selectors, verifier behaviour, and DMARC alignment, so teams should harden today’s email authentication controls while tracking algorithm agility.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “DKIM and Post-Quantum Cryptography: Keep Calm and Fix the Basics”.

Key questions

Q: What breaks when DKIM signatures become forgeable after quantum advances?

A: The break is sender trust, not message confidentiality.

Q: When should organisations prioritise DKIM agility versus other post-quantum work?

A: Organisations should prioritise DKIM agility after they have secured the long-lived confidentiality assets that quantum risk threatens first, such as TLS, VPNs, archives, code signing, and private PKI.

Q: What are the signs that email authentication controls are not working well enough?

A: Warning signs include users still receiving convincing spoofed emails, phishing attempts reaching inboxes, and recipients having no easy way to verify sender authenticity.

Practitioner guidance

• Harden current email authentication controls Enforce aligned SPF, DKIM, and DMARC policies, then move DMARC from monitoring to rejection where sending sources are known and stable.
• Rationalise DKIM selectors and signing domains Track every active selector, retire unused ones, and ensure each signing source has a clear owner and lifecycle so future algorithm changes are manageable.
• Inventory long-lived cryptographic exposure Map TLS certificates, VPNs, encrypted archives, code signing, private PKI, S/MIME, and machine identities so post-quantum priorities reflect actual retention risk.

Bottom line: DKIM’s post-quantum problem is future forgery, which makes sender trust the core issue rather than historical message confidentiality.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →