DKIM (DomainKeys Identified Mail) is an email authentication method that digitally signs each outgoing email. The sending service signs with a private key, and you publish the matching public key in your DNS. Receiving servers use it to verify the email came from your domain and wasn't altered on the way.
Why it matters
- Proves message integrity and origin
- Is required for bulk senders by Gmail and Yahoo
- Is one of the two checks (with SPF) that DMARC relies on
What a DKIM record looks like
Host: s1._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkq...
The s1 part is the selector; your email provider tells you which one to use. Each sending service usually needs its own DKIM key.
Best practices
- Enable DKIM in every service that sends as your domain
- Use 2048-bit keys where supported
- Rotate keys periodically
- Check "Show original" in Gmail for
DKIM: PASS
Example
A D2C brand enables DKIM for its store's order emails and its newsletter SMTP. Both now show "signed-by: brand.com" in Gmail, which improves trust and placement.
Questions first? Chat with us on WhatsApp