What DKIM does
DKIM (DomainKeys Identified Mail) attaches a digital signature to the headers and body of every outgoing message. The signature is made with a private key that only your sending system holds, and it can be verified with a matching public key you publish in DNS.
When a receiver gets your mail, it fetches that public key, checks the signature, and confirms two things: the message really was authorised by your domain, and nothing in it was changed in transit.
How the pieces fit together
Two halves make DKIM work. Your mail provider signs each message with a private key and stamps a DKIM-Signature header on it. That header names a selector - a short label that points at the right public key.
You publish the public key as a DNS TXT record at selector._domainkey.yourdomain.com. The receiver reads the selector from the header, looks up that exact record, and uses the key it finds to verify the signature.
selector1._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."Setting up DKIM
You rarely generate keys by hand - your sending platform does it. The flow is almost always:
- In your mail or marketing provider, turn on DKIM (sometimes called email authentication or a signing key) for your domain.
- The provider shows one or more DNS records - usually a CNAME or TXT at a selector name like s1._domainkey.
- Add those exact records at your DNS host, copied character for character.
- Back in the provider, click verify. Once DNS propagates it confirms signing is live.
- Send yourself a test message and check that DKIM shows a pass in the headers or in a scan.
Why a pass matters beyond signing
DKIM survives forwarding, which SPF does not - so a solid DKIM signature is often what keeps forwarded mail authenticated. It is also one of the two ways a message can satisfy DMARC.
That makes DKIM the backbone of deliverability: without it, DMARC has only SPF to lean on, and any forwarded or relayed mail is far more likely to fail and land in spam.