Glossary
DKIM (DomainKeys Identified Mail)
A cryptographic signature added by a signing domain, letting a receiver verify with a public key published in DNS that the domain takes responsibility for the message.
In plain terms
A tamper-evident signature that proves a domain stands behind the message.
Why it matters for deliverability
Unlike SPF, DKIM survives forwarding, because the signature travels with the message rather than depending on the connecting IP. That makes it the more durable half of a DMARC setup.
What to do about it
- Sign all outbound mail, including transactional and third-party sends.
- Use at least a 1024-bit key, and rotate keys using selectors.
- Check that your ESP signs with your domain rather than only its own.
Source
RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
“Assertion of responsibility is validated through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key.”
Checked 2026-08-29
Go deeper
Definitions reviewed 2026-08-29. Spotted something wrong? Tell us.
See how your own mail is handled
Run a real message through MailTester and read the authentication results, spam score and delivery signals described on this page against your own domain.