dkimpy

What it is and what it does

dkimpy is a cryptographic email authentication library that signs and verifies DKIM signatures on RFC822-formatted messages. It implements the core DKIM standard (RFC 6376) plus modern extensions: ed25519-sha256 signing (RFC 8463), ARC chain validation (RFC 8617), and TLSRPT service type support (RFC 8460). The library provides both a programmatic API and command-line tools (dknewkey, dkimsign, dkimverify). It requires DNS lookups to validate public keys, which can be performed synchronously or asynchronously.

The package is designed for mail transport agents, filters, and email infrastructure that need to cryptographically authenticate sender identity. It handles RSA keys (minimum 1024 bits per RFC 8301) and ed25519 keys, with optional support for ARC multi-hop authentication chains. The library is stable and production-ready but dormant: the last release was 771 days ago, so active maintenance and security updates are not expected.

Use it for:

• Sign outgoing mail in a mail transport agent or filter to prove sender domain ownership
• Verify DKIM signatures on incoming messages to detect spoofing and validate sender authentication
• Validate ARC chains on forwarded messages to trace authentication through multiple hops
• Generate ed25519 key pairs for modern DKIM deployments requiring new cryptographic algorithms
• Implement async verification in high-throughput mail processing pipelines

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements DKIM (DomainKeys Identified Mail) email signing and verification, along with ARC (Authenticated Receive Chain) and TLSRPT support for cryptographic email authentication.

Yes, if you need DKIM/ARC email authentication and can accept dormant maintenance. The library is production-stable with no known vulnerabilities and permissive licensing. However, high install friction (manual setup.py incantation for scripts) and 771-day release gap mean you should verify it works with your Python version and DNS resolver before production use.

Install

dkimpy on PyPI

pip install dkimpy

uv add dkimpy

poetry add dkimpy

Installing dkimpy

Before you install

High install friction: the package requires manual setup.py incantation for scripts and man pages installation. Dormant maintenance status (771 days since last release) means bug fixes and security updates are unlikely, though the library has been stable since its early releases.

License in practice

BSD-like permissive license allows commercial and private use with minimal restrictions, typical of email infrastructure libraries.

Quickstart

pip install dkimpy

# Sign a message
message = b'From: sender@example.com\nTo: recipient@example.com\nSubject: Test\n\nBody'
signature = sign(message, b'selector', b'example.com', open('private.key', 'rb').read())

# Verify a message
result = verify(message)

Requires dnspython or py3dns for DNS lookups; ed25519 signing requires PyNaCl; async verification requires aiodns and Python 3.5+. Scripts installation requires: python3 setup.py install --single-version-externally-managed --record=/dev/null

Verify before relying

• Whether dnspython or py3dns is automatically installed or must be manually selected
• Current compatibility with Python versions beyond 3.5 (minimum stated requirement)
• Whether ed25519, ARC, and asyncio extras are actively maintained alongside core functionality
• Whether the library correctly handles non-ASCII and non-UTF-8 content as documented

Package facts

Evidence: dkimpy-1.1.8.tar.gz

Tags

More Python Modules packages