import React from 'react';
import {GuideLayout, InfoBox} from '../../components/guides';
import {CodeBlock} from '../../components/CodeBlock';
import Link from 'next/link';

export default function WhatIsDKIM() {
  return (
    <GuideLayout
      title="What is DKIM? Email Authentication Explained"
      description="Learn how DKIM (DomainKeys Identified Mail) protects your emails from spoofing and improves deliverability. Complete guide with setup examples."
      lastUpdated="2025-12-20"
      readTime="8 min"
      canonical="https://www.useplunk.com/guides/what-is-dkim"
    >
      {/* Introduction */}
      <section id="introduction" className="mb-12">
        <p className="text-neutral-700 leading-relaxed">
          DKIM (DomainKeys Identified Mail) is an email authentication method that allows receiving mail servers to
          verify that an email was actually sent by the domain it claims to be from and that the message wasn't altered
          in transit.
        </p>
        <p className="mt-4 text-neutral-700 leading-relaxed">
          Think of DKIM as a digital signature for your emails—like a wax seal on a letter that proves it's authentic
          and hasn't been tampered with.
        </p>
      </section>

      {/* How DKIM Works */}
      <section id="how-dkim-works" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">How DKIM Works</h2>
        <p className="text-neutral-700 leading-relaxed mb-6">
          DKIM uses cryptographic authentication to validate emails. Here's the process:
        </p>

        <div className="space-y-6 mb-8">
          <div className="">
            <h3 className="text-xl font-semibold text-neutral-900 mb-2">1. The Sending Server Signs the Email</h3>
            <p className="text-neutral-700">
              When you send an email, your email server adds a DKIM signature to the email header. This signature is
              created using a private key that only your server knows.
            </p>
          </div>

          <div className="">
            <h3 className="text-xl font-semibold text-neutral-900 mb-2">2. The Signature is Added to Headers</h3>
            <p className="text-neutral-700">
              The DKIM signature includes a hash of specific email components (like the subject, body, and sender) and
              is added to the email headers as a "DKIM-Signature" field.
            </p>
          </div>

          <div className="">
            <h3 className="text-xl font-semibold text-neutral-900 mb-2">3. The Receiving Server Verifies</h3>
            <p className="text-neutral-700">
              When the email arrives, the receiving server looks up your domain's public DKIM key in DNS, then uses it
              to verify the signature. If everything matches, the email passes DKIM authentication.
            </p>
          </div>

          <div className="">
            <h3 className="text-xl font-semibold text-neutral-900 mb-2">4. Delivery Decision</h3>
            <p className="text-neutral-700">
              Passing DKIM verification improves your sender reputation and deliverability. Failing or missing DKIM may
              result in emails being flagged as suspicious or sent to spam.
            </p>
          </div>
        </div>

        <InfoBox type="tip" title="Technical Detail">
          <p>
            DKIM uses asymmetric cryptography (public/private key pairs). The private key stays secure on your mail
            server, while the public key is published in your DNS records for anyone to verify.
          </p>
        </InfoBox>
      </section>

      {/* DKIM Record Example */}
      <section id="dkim-record-example" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">What Does a DKIM Record Look Like?</h2>
        <p className="text-neutral-700 leading-relaxed mb-6">
          A DKIM record is a TXT record in your DNS that contains your public key. Here's an example:
        </p>

        <div className="w-full max-w-full overflow-x-auto">
          <CodeBlock
            language="dns"
            title="Example DKIM DNS Record"
            code={`default._domainkey.yourdomain.com  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3QEKyU1fSma0axspqYK5iAj+54lsAg4qRRCnpKK68hawSJfliq9vKD6czJ..."

# Breaking down the components:
# v=DKIM1          -> DKIM version
# k=rsa            -> Key type (RSA encryption)
# p=MIGfMA0...     -> Public key (base64 encoded)`}
          />
        </div>

        <InfoBox type="info" title="Selector Names">
          <p>
            The "default" in <code>default._domainkey</code> is called a selector. You can use different selectors to
            rotate keys or separate different email streams (e.g., marketing, transactional).
          </p>
        </InfoBox>
      </section>

      {/* Why DKIM Matters */}
      <section id="why-dkim-matters" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">Why DKIM Matters for Email Deliverability</h2>

        <div className="grid gap-6 md:grid-cols-2 mb-8">
          <div className="rounded-xl border border-neutral-200 bg-white p-6">
            <div className="w-full max-w-full wrap-break-word">
              <h3 className="text-lg font-semibold text-neutral-900 mb-3">Prevents Email Spoofing</h3>
              <p className="text-neutral-700">
                DKIM makes it nearly impossible for spammers to forge emails from your domain. The cryptographic
                signature can't be replicated without your private key.
              </p>
            </div>
          </div>

          <div className="rounded-xl border border-neutral-200 bg-white p-6">
            <div className="w-full max-w-full wrap-break-word">
              <h3 className="text-lg font-semibold text-neutral-900 mb-3">Improves Deliverability</h3>
              <p className="text-neutral-700">
                Major email providers (Gmail, Outlook, Yahoo) use DKIM as a trust signal. Emails with valid DKIM
                signatures are more likely to reach the inbox.
              </p>
            </div>
          </div>

          <div className="rounded-xl border border-neutral-200 bg-white p-6">
            <div className="w-full max-w-full wrap-break-word">
              <h3 className="text-lg font-semibold text-neutral-900 mb-3">Protects Brand Reputation</h3>
              <p className="text-neutral-700">
                By preventing domain spoofing, DKIM protects your brand from being used in phishing attacks that could
                damage your reputation.
              </p>
            </div>
          </div>

          <div className="rounded-xl border border-neutral-200 bg-white p-6">
            <div className="w-full max-w-full wrap-break-word">
              <h3 className="text-lg font-semibold text-neutral-900 mb-3">Enables DMARC</h3>
              <p className="text-neutral-700">
                DKIM is a prerequisite for implementing DMARC, which provides even stronger email authentication and
                reporting capabilities.
              </p>
            </div>
          </div>
        </div>

        <InfoBox type="warning" title="Gmail & Yahoo Requirements">
          <p>
            As of February 2024, Gmail and Yahoo require DKIM authentication for bulk senders (5,000+ emails/day). Even
            if you send less, implementing DKIM is considered a best practice.
          </p>
        </InfoBox>
      </section>

      {/* DKIM Signature Example */}
      <section id="dkim-signature-example" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">What Does a DKIM Signature Look Like?</h2>
        <p className="text-neutral-700 leading-relaxed mb-6">
          When you send an email, the DKIM signature is added to the email headers. Here's what it looks like:
        </p>

        <CodeBlock
          language="text"
          title="DKIM-Signature Header Example"
          code={`DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
  d=yourdomain.com; s=default;
  h=from:subject:date:message-id:to;
  bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;
  b=GJwP3Qr8KqKKKNT5HL8j3fjXvLEm9KmZs6YdO2KqEqr...

# Key components:
# v=1                -> DKIM version
# d=yourdomain.com   -> Signing domain
# s=default          -> Selector (matches DNS record)
# h=from:subject...  -> Headers included in signature
# bh=frcCV1...       -> Hash of email body
# b=GJwP3Q...        -> The actual signature`}
        />
      </section>

      {/* How Plunk Handles DKIM */}
      <section id="plunk-dkim" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">How Plunk Simplifies DKIM</h2>
        <p className="text-neutral-700 leading-relaxed mb-6">
          Setting up DKIM manually can be complex, but Plunk makes it automatic:
        </p>

        <div className="space-y-4 mb-8">
          <div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
            <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
              1
            </div>
            <div>
              <h3 className="font-semibold text-neutral-900 mb-2">Automatic Key Generation</h3>
              <p className="text-neutral-700">
                Plunk automatically generates secure DKIM key pairs for your domain when you add it to your account.
              </p>
            </div>
          </div>

          <div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
            <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
              2
            </div>
            <div>
              <h3 className="font-semibold text-neutral-900 mb-2">Simple DNS Setup</h3>
              <p className="text-neutral-700">
                We provide the exact DNS records you need to add—just copy and paste into your DNS provider.
              </p>
            </div>
          </div>

          <div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
            <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
              3
            </div>
            <div>
              <h3 className="font-semibold text-neutral-900 mb-2">Automatic Signing</h3>
              <p className="text-neutral-700">
                Every email you send through Plunk is automatically signed with DKIM. No configuration needed.
              </p>
            </div>
          </div>

          <div className="flex items-start gap-4 p-6 rounded-xl bg-neutral-50 border border-neutral-200">
            <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-neutral-900 text-white text-sm font-bold">
              4
            </div>
            <div>
              <h3 className="font-semibold text-neutral-900 mb-2">Verification & Monitoring</h3>
              <p className="text-neutral-700">
                Plunk verifies your DKIM setup and monitors authentication status for all your emails.
              </p>
            </div>
          </div>
        </div>

        <InfoBox type="success" title="Ready in Minutes">
          <p>
            Most Plunk users have DKIM fully configured and working within 5-10 minutes. Our dashboard guides you
            through every step.
          </p>
        </InfoBox>
      </section>

      {/* DKIM Best Practices */}
      <section id="dkim-best-practices" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">DKIM Best Practices</h2>

        <div className="space-y-6">
          <div className="py-2">
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">✓ Use 2048-bit Keys</h3>
            <p className="text-neutral-700">
              While 1024-bit keys still work, 2048-bit keys provide better security and are recommended by Gmail and
              other providers.
            </p>
          </div>

          <div className="py-2">
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">✓ Implement SPF and DMARC Too</h3>
            <p className="text-neutral-700">
              DKIM works best when combined with SPF and DMARC for comprehensive email authentication. Use all three for
              maximum protection.
            </p>
          </div>

          <div className="py-2">
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">✓ Monitor DKIM Status</h3>
            <p className="text-neutral-700">
              Regularly check that your DKIM signatures are passing. Most email platforms provide authentication
              reports.
            </p>
          </div>

          <div className="py-2">
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">✓ Rotate Keys Periodically</h3>
            <p className="text-neutral-700">
              For enhanced security, rotate your DKIM keys every 6-12 months. Plan key rotation carefully to avoid
              delivery disruptions.
            </p>
          </div>

          <div className="py-2">
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">✗ Don't Share Private Keys</h3>
            <p className="text-neutral-700">
              Your DKIM private key should never be shared or stored insecurely. Treat it like a password.
            </p>
          </div>

          <div className="py-2">
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">✗ Don't Use the Same Key Across Domains</h3>
            <p className="text-neutral-700">
              Each domain should have its own unique DKIM key pair for security and proper authentication.
            </p>
          </div>
        </div>
      </section>

      {/* Related Guides */}
      <section id="related-guides" className="mb-12">
        <h2 className="text-3xl font-bold text-neutral-900 mb-6">Related Email Authentication Guides</h2>
        <div className="grid gap-4 md:grid-cols-3">
          <Link
            href="/guides/what-is-spf"
            className="block rounded-xl border border-neutral-200 bg-white p-6 transition hover:border-neutral-300 hover:shadow-lg"
          >
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">What is SPF?</h3>
            <p className="text-sm text-neutral-600">Learn about SPF records and how they complement DKIM.</p>
          </Link>
          <Link
            href="/guides/what-is-dmarc"
            className="block rounded-xl border border-neutral-200 bg-white p-6 transition hover:border-neutral-300 hover:shadow-lg"
          >
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">What is DMARC?</h3>
            <p className="text-sm text-neutral-600">Complete guide to DMARC policies and email security.</p>
          </Link>
          <Link
            href="/guides/email-deliverability"
            className="block rounded-xl border border-neutral-200 bg-white p-6 transition hover:border-neutral-300 hover:shadow-lg"
          >
            <h3 className="text-lg font-semibold text-neutral-900 mb-2">Email Deliverability Guide</h3>
            <p className="text-sm text-neutral-600">Improve your email deliverability with best practices.</p>
          </Link>
        </div>
      </section>
    </GuideLayout>
  );
}
