What is DKIM (DomainKeys Identified Mail)?

Your email service holds a private key and uses it to sign each outgoing message, adding a DKIM-Signature header. The matching public key sits in a DNS TXT record at a name made from a selector and your domain, in the form selector._domainkey.your-domain.com. The receiving server fetches the key, checks the signature, and knows the signed parts of the message are intact.

Unlike SPF, a DKIM signature travels with the message, so it generally survives forwarding. Each sending service uses its own selector, which means you can have several DKIM records side by side: one for your mailbox provider, one for your transactional email service, one for your newsletter tool.

Setup consists of copying the records your email provider gives you into your DNS and then switching signing on in the provider's dashboard. The common mistakes are skipping that last step, pasting a long key incorrectly so that it is cut short, and forgetting to set DKIM up for a second sending service added later. DKIM alone does not tell receivers what to do when a check fails. That is the job of DMARC.