DKIM
DKIM (DomainKeys Identified Mail) lets a sending domain cryptographically sign outgoing email with a private key, adding a DKIM-Signature header that covers key parts of the message. The receiving server looks up the corresponding public key from a DNS TXT record at a selector-specific hostname (selector._domainkey.example.com) and verifies the signature, confirming the message wasn't altered after signing and genuinely originated from a system holding that domain's private key. Unlike SPF, which authenticates the sending IP, DKIM authenticates the message content itself and survives forwarding through an intermediate server, which is why DMARC checks both mechanisms together. DKIM is defined in RFC 6376.
By AdminKit team, Netbase JSC · Updated