DKIM

What it means

DKIM, short for DomainKeys Identified Mail, adds a digital signature to each outgoing email. Your mail server signs selected headers and the body with a private key. The matching public key is published in your DNS, so any receiver can verify the signature and confirm the message was not altered.

The signature sits in a DKIM-Signature header. It names the signing domain and a selector, which tells the receiver where to find the key at selector._domainkey.yourdomain. Using selectors means you can run several keys at once and swap them without a gap.

Why it matters

DKIM gives receivers a reliable sign that a message passed through a system your domain controls, and that nobody edited it on the way. That supports reputation: mail that verifies is easier to deliver, and forged mail is easier to spot. It also feeds DMARC, which needs a passing SPF or DKIM result.

It can fail without anyone noticing. A message changed in transit, such as a mailing list adding a footer, can break the signature. A key left in place for years, or a weak one, raises the risk that someone could forge signatures if the private key leaks.

How it shows up

You set it up in your email provider’s settings, which gives you a record to publish in DNS. Every service that sends mail for you, such as marketing tools and your product’s notification system, needs its own DKIM setup for your domain. Test by sending a message and reading the authentication results in the headers.

The mistakes: signing only some senders, using a very short key, never rotating keys, and publishing the record on the wrong name. Use at least 2048-bit keys where supported, rotate with a new selector, and remove selectors for services you stopped using. Treat the private key as a secret under your secrets management.