title: DKIM: To each their own or one to rule them all?
body: <p>I have been handed over responsibility for an email gateway serving multiple domains and got into a bit of a philosophical debate with a colleague.
  In our setup the gateway is the instance adding DKIM signatures to all outgoing emails and I am told that we need a different DKIM key pair per domain, I don't object this request, but no-one seems to be able to explain why.</p>
  <p>Here's my understanding of the DKIM process:</p>
  <ol>
  <li><p>Private DKIM key (one for all or one per domain) is kept on the gateway</p>
  </li>
  <li><p>Public DKIM key is published in the domains DNS records</p>
  </li>
  <li><p>For each outgoing email the gateway will encrypt a random string with the private key and add it to the email header, alongside with the clear text string and the name (selector) of the DKIM entry in DNS.</p>
  </li>
  <li><p>The receiving email server…</p>
  <p>a, takes sending domain and DKIM selector from email header</p>
  <p>b, looks up the public key stored in DNS of sending domain</p>
  <p>c, uses the public DKIM key to decrypt the encrypted string in the email header</p>
  </li>
  <li><p>If the decrypted string matches the clear-text one, DKIM verification is successful</p>
  </li>
  </ol>
  <p>If the above is correct, why would I need domain individual DKIM keys? Why can't all domains hosted on the same server share the same public/private DKIM keys? In fact if DKIM is supposed to prove the validity of the sending server, wouldn't it even be more accurate to use the same key pair for all domains given that it is the same server for all of them?</p>
  <p>From a technical point of view I think both concepts will work, with domain specific DKIM keys representing a little more work as the number of domains grows.
  I'd be happy to go with individual key pairs, but I'd like to understand why.</p>
  <p>Any benefits/downsides of going either way?
  Anyone got an opinion?</p>