DomainKeys Identified Mail (DKIM) is an email authentication standard that adds a cryptographic signature to every outgoing message, allowing the receiver to verify the message was authorised by the claimed sender domain and not modified in transit.
DKIM works by publishing a public key in DNS at `<selector>._domainkey.<domain>`. The sending mail server signs each outgoing message with the matching private key; the receiver looks up the public key, verifies the signature, and confirms domain alignment.
Unlike SPF, DKIM survives email forwarding intact, which is why both are needed in production.
DKIM plus SPF plus DMARC is now the table-stakes email authentication stack. Without all three correctly configured, mail from your domain will be silently throttled or dropped by Gmail, Yahoo, and Microsoft 365.
See it in the product: Email deliverability.