---
title: "DKIM (DomainKeys Identified Mail) — monitoring glossary"
description: "DomainKeys Identified Mail (DKIM) is an email authentication standard that adds a cryptographic signature to every outgoing message, allowing the receiver to…"
canonical: "https://lemwatch.com/glossary/dkim"
source: "https://lemwatch.com"
---

# DKIM (DomainKeys Identified Mail)

> DomainKeys Identified Mail (DKIM) is an email authentication standard that adds a cryptographic signature to every outgoing message, allowing the receiver to verify the message was authorised by the claimed sender domain and not modified in transit.

## Definition

 DKIM works by publishing a public key in DNS at `<selector>._domainkey.<domain>`. The sending mail server signs each outgoing message with the matching private key; the receiver looks up the public key, verifies the signature, and confirms domain alignment.

 Unlike SPF, DKIM survives email forwarding intact, which is why both are needed in production.

## Why it matters

 DKIM plus SPF plus DMARC is now the table-stakes email authentication stack. Without all three correctly configured, mail from your domain will be silently throttled or dropped by Gmail, Yahoo, and Microsoft 365.

 See it in the product: [Email deliverability](https://lemwatch.com/features).


## Related

- [Monitoring glossary](https://lemwatch.com/glossary)
- [SPF](https://lemwatch.com/glossary/spf)
- [DMARC](https://lemwatch.com/glossary/dmarc)
- [DNS](https://lemwatch.com/glossary/dns)
- [Domain Expiry](https://lemwatch.com/glossary/domain-expiry)
- [All monitoring checks](https://lemwatch.com/features)
- [CSP (Content Security Policy)](https://lemwatch.com/glossary/csp)