DKIM (DomainKeys Identified Mail)

A cryptographic signature added to every outgoing message, letting receivers verify it genuinely came from your domain and was not altered on the way.

[01]What It Means

Your sending service signs each message with a private key. The matching public key sits in your DNS under a selector, and receiving servers use it to check the signature.

Unlike SPF, DKIM travels with the message. If someone forwards your email, the signature still validates, which is why DKIM is the more durable of the two proofs.

Each sending service needs its own key and selector. A domain sending through a mailbox provider, a CRM and a transactional service will normally publish three separate DKIM records.

[02]Why It Matters

DKIM is what survives the real world. Forwarding, mailing lists and email gateways routinely break SPF alignment, and without a valid signature a legitimate message then fails DMARC and disappears. It is also the prerequisite for any brand-level display standard later.

[03]Where It Goes Wrong

A malformed record, which fails silently and looks identical to no recordKeys published for one service while another sends unsignedRotating keys at the provider without updating DNS

[04]Related Terms