'/%3e%3ccircle%20cx='100'%20cy='100'%20r='84'%20fill='%23093e47'/%3e%3ccircle%20cx='100'%20cy='100'%20r='79'%20fill='url(%23teal)'/%3e%3cg%20transform='translate(55,55)'%20stroke='url(%23cmd)'%20stroke-width='11'%20fill='none'%20stroke-linecap='round'%20stroke-linejoin='round'%3e%3crect%20x='27'%20y='27'%20width='36'%20height='36'%20rx='5'/%3e%3ccircle%20cx='13.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='13.5'%20r='13.5'/%3e%3ccircle%20cx='13.5'%20cy='76.5'%20r='13.5'/%3e%3ccircle%20cx='76.5'%20cy='76.5'%20r='13.5'/%3e%3c/g%3e%3c/svg%3e)
DKIM, or DomainKeys Identified Mail, is an authentication method that attaches a digital signature to the headers of every message you send. The sending server signs selected headers and the body with a private key, and the receiving server retrieves the matching public key from your DNS to verify that signature.
The public key lives in a DNS TXT record at a special hostname called the selector, for example selector1._domainkey.example.com. Because only the holder of the private key can produce a valid signature, DKIM proves both that the message genuinely originated from an authorized system and that it was not tampered with in transit.
DKIM is one of the three pillars of modern email authentication alongside SPF and DMARC. Unlike SPF, which is tied to the sending IP, DKIM survives forwarding because the signature travels with the message. This makes it especially valuable for mailing lists and any path where messages are relayed before reaching the inbox.
For senders, using at least a 2048-bit key and rotating keys periodically is best practice. A broken DKIM signature — caused by a mangled record, an expired selector, or content modification by an intermediary — will fail DMARC alignment and hurt deliverability, so verifying your DKIM setup before a campaign is essential.