What Is DKIM and How Does It Work?

DKIM is one of the three pillars of email authentication, alongside SPF and DMARC. Here's what DKIM is, how it works, and why your domain needs it.

DKIM in one sentence

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message you send, so the receiving server can confirm two things: the mail really came from your domain, and it wasn't altered in transit.

How DKIM works, step by step

1. You publish a public key in your domain's DNS, on a record called a selector.
2. When you send mail, your server signs the message with the matching private key and adds a DKIM-Signature header.
3. The receiving server looks up your public key in DNS and uses it to verify the signature.
4. If it matches, the message passes DKIM - proof it's authentic and untampered.

You can see the signature yourself in the raw message - see how to read an email header.

Why DKIM matters

• Deliverability - signed mail is far more likely to reach the inbox, see how to improve email deliverability
• Anti-spoofing - makes it much harder for others to forge your domain, see what is email spoofing and how to prevent it
• It's required for DMARC - DMARC relies on SPF and DKIM to decide what to do with mail, see what is a DMARC policy

DKIM, SPF and DMARC together

DKIM is one layer. SPF verifies which servers may send for your domain, and DMARC ties them together and tells receivers what to do when checks fail. The full picture is in SPF, DKIM and DMARC explained.

The catch: it has to be set up right

A missing or misconfigured selector means mail fails DKIM silently. Getting the keys and DNS records correct matters.

Set up once, done right

DigiCloudMail configures DKIM (along with SPF and DMARC) for your domain, so your mail is signed, trusted and delivered - with none of the DNS guesswork.

Want your email properly authenticated? Contact us.