DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) adds a digital signature to each message so receivers can verify it wasn't altered and really comes from your domain.
DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing message so receiving servers can check that it was authorized by your domain and not altered in transit.
How it works
The sending service holds a private key and publishes the matching public key in DNS under a selector, at a hostname like {selector}._domainkey.example.com. Each message is signed with the private key. The receiving server looks up the public key named in the signature header and verifies the signature. If the signed parts of the message changed on the way, verification fails.
SPF checks whether the sending IP is allowed to send for a domain. DKIM checks the message itself. DMARC then uses either result, provided the domain it passed for aligns with the visible From domain.
Common mistakes
Publishing the record at the root domain instead of
{selector}._domainkey.example.com.Line breaks or stray characters in the
p=value. Paste the key exactly as provided.Never rotating keys. Selectors let you publish a new key and switch without downtime.
DKIM passes but DMARC fails because the
d=domain does not align with the visible From domain. Adjust the signing domain or the DMARC alignment setting.Several senders sharing one selector, which causes conflicts when one rotates or changes provider. Give each sender its own selector.