What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method in which the sending server adds a digital signature to each email with a private key, and the receiving server verifies that signature with the public key published in the domain's DNS. It proves the message was not altered in transit and was sent with the domain's authorization.

Last updated: 20 October 2026View as Markdown

In short

DKIM is a core part of email deliverability: together with SPF and DMARC, it lets receiving servers trust that a message genuinely comes from your domain. It has to be enabled separately for every service that sends on your behalf, such as corporate email, a marketing platform, a CRM or an outbound tool. Because the signature survives forwarding while SPF often breaks, DKIM is the most reliable signal for DMARC alignment. Gmail and Yahoo also require authentication from bulk senders.

Key points

DKIM adds a digital signature tied to your domain to every email.
The public key is published in DNS at selector._domainkey.yourdomain.com.
DKIM must be enabled separately for every service that sends email for your domain.
SPF can break when messages are forwarded, but the DKIM signature survives.
Rotating DKIM keys periodically is recommended for security.

How does it work?

The sending service generates a key pair. Specific headers and the body of the message are signed with the private key; the public key is published as a DNS record at selector._domainkey.yourdomain.com. The receiving server verifies the signature with that key.

What to watch

DKIM must be enabled separately for every sending service: corporate email, marketing tool, CRM and outbound tool. Rotating keys periodically is recommended for security.

Why it matters

DKIM is the most reliable signal for DMARC's alignment check; when messages are forwarded, SPF can break but the DKIM signature survives. More detail: What are DMARC, SPF and DKIM.

Last updated: 20 October 2026