DKIM
DomainKeys Identified Mail — a DNS record and cryptographic signature that proves an email was not altered in transit and actually came from your server.
DomainKeys Identified Mail — a DNS record and cryptographic signature that proves an email was not altered in transit and actually came from your server.
What DKIM adds that SPF does not
SPF says which servers may send for a domain. DKIM says this specific message was signed by that domain and has not been altered since. The sending server signs selected headers and the body with a private key, and puts the result in a DKIM-Signature header. The matching public key sits in your DNS.
Because the signature travels with the message, DKIM survives forwarding, where SPF usually breaks (the forwarder's IP is not on your list).
How a receiver verifies it
The signature header carries two tags that find the key:
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=google; ...
d=is the signing domain.s=is the selector.
The receiver looks up the TXT record at s._domainkey.d — here google._domainkey.yourdomain.com — reads the public key from the p= tag, and checks the signature against it.
Things that go wrong
- Published but not enabled. Many providers need you to switch signing on after the DNS record exists. Until then they sign with their own domain, which passes DKIM but does not align with your From address.
- A truncated or split key. A 2048-bit key is longer than one 255-character DNS string; some hosts need it split into several quoted strings, and some mangle it.
- A doubled hostname. Pasting the full name into a field that appends the domain gives
google._domainkey.yourdomain.com.yourdomain.com. - A 1024-bit key. Still works, but 2048 is the sensible default where your DNS host allows it.
The fastest test: send a message to a Gmail address, open Show original, and read the DKIM line. See also SPF and the setup guide for each provider.
Related
- SPF — cold email glossary
Sender Policy Framework — a DNS TXT record listing which servers are authorized to send mail for your domain. Mail from an unlisted server looks forged, whether it actually is or not.
- DMARC — cold email glossary
Domain-based Message Authentication — a DNS record telling receivers what to do when SPF or DKIM fails (allow, quarantine, or reject), and where to send reports about who is sending as your domain.
- Cold email & deliverability glossary
Plain-language definitions for the terms that come up in cold outreach and email deliverability: bounce rate, catch-all, SPF/DKIM/DMARC, sender reputation, and more.
- Bounce rate — cold email glossary
The share of sent emails a mail server refuses to deliver. A hard bounce means the mailbox does not exist; a soft bounce means it is temporarily unreachable.