How DKIM proves a message is genuine and unaltered - and the signing mistakes that break DMARC alignment.
What DKIM Is
DomainKeys Identified Mail (DKIM) attaches a cryptographic signature to every message you send. Your mail server signs each message with a private key; the matching public key is published in your DNS. The receiving server fetches the public key, recomputes the signature, and if it matches, two things are proven: the message really came from your domain, and it was not altered in transit.
Why DKIM Beats SPF at One Thing
Unlike SPF, DKIM survives forwarding. Because the signature travels with the message rather than depending on the connecting server's IP, a forwarded message still validates. That makes DKIM the more robust of the two authentication checks - and the one DMARC alignment most often relies on.
Keys and Selectors
DKIM uses selectors so a domain can run several keys at once (for different services or for key rotation). The public key lives at <selector>._domainkey.<domain> in DNS. Use at least a 2048-bit key where your provider supports it, and rotate keys periodically.
Common Mistakes
Not signing at all - many senders publish SPF and stop. A broken or truncated key record - long keys sometimes get split incorrectly in DNS. Signing with the wrong domain so DKIM passes but doesn't align with the From, which fails DMARC. Always confirm the signing domain (d=) matches your From domain.
Frequently Asked Questions
What is DKIM?
What is the difference between SPF and DKIM?
What is a DKIM selector?
Emails landing in spam?
Henry Timmes diagnoses why your mail isn't reaching the inbox - Microsoft 365, Gmail, Yahoo and beyond - and maps a practical fix. Book a free 15-minute call, no obligation.
Book a free consultation