As far as I understand DKIM works like this:

  - [DKIM][1] is not used to encrypt anything, the only purpose is to mark mails that are not really sent from the claimed domain as **spam**.
  - the DKIM-enabled **sending server** uses a stored private key to generate a digital signature of the message, which is inserted in the message as a header, and the email is sent as normal
  - The DKIM-enabled receiving email **receiving server** extracts the signature and claimed *From:* domain from the email headers.
  -  The public key is retrieved from the DNS system for the claimed *From:* domain.
  -  The public key is used by the receiving mail system to verify that **the signature was generated by the matching private key**. A match effectively proves that the email was truly sent from, and with the permission of, the claimed domain and that the message headers and content have not been altered during transit.
  -   The receiving email system applies local policies based on the results of the signature test. For example, the message might be deleted if the signature does not match.

This is all understandable, the only magic seems to me, how you can check if the signature really was generated with the private key (which the receiving server doesn't know)

Is there an intuitive way to explain how you can check if the signature was generated by the matching private key?


  [1]: http://en.wikipedia.org/wiki/DomainKeys_Identified_Mail