DKIM (DomainKeys Identified Mail)
A cryptographic signature added to outgoing emails that proves the message really came from your domain and was not tampered with.
DKIM (RFC 6376) lets the sending server sign each message with a private key. The signature travels in a DKIM-Signature header that names a signing domain (d=) and a selector (s=). The receiving server fetches the matching public key from DNS at selector._domainkey.yourdomain.com and checks that the signed headers and body were not changed in transit. A valid signature ties the message to the signing domain, which makes DKIM a core input to sender reputation and to DMARC.
How to set up DKIM
Your email platform generates the key pair and gives you one or more DNS records (TXT or CNAME) to publish under its selector. Publish them exactly as given, wait for DNS to update, then turn on signing in the platform. Google requires a DKIM key of at least 1,024 bits from anyone sending to personal Gmail accounts, and Google Workspace recommends 2,048-bit keys where your DNS host supports them.
To confirm it works, send a test to a Gmail address, open the message, choose Show original and look for DKIM: PASS next to your own domain. Senders of more than 5,000 messages a day to Gmail must sign with DKIM and also publish SPF and DMARC.
Common DKIM mistakes
Signing with the platform's shared domain instead of yours. Many tools sign with their own domain by default: the message passes DKIM, but the signature does not align with your From domain, so it does nothing for DMARC. Set up a custom (branded) sending domain in your platform.
Other frequent problems: a DNS host that splits a long TXT value incorrectly, an old selector left published after you switch platforms, and keys that are never rotated. Rotation is low-risk because a new selector can be published alongside the old one before you switch.
Sources
Related terms
SPF (Sender Policy Framework)
A DNS record that lists which servers are allowed to send email on behalf of your domain.
DMARC
A policy you publish in DNS that tells inbox providers what to do if SPF or DKIM checks fail.
Deliverability
The ability to consistently land in the inbox rather than the spam folder or being rejected.