What is DKIM?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
When your email travels from your sending server to someone's inbox, it passes through multiple systems. Any of those systems could theoretically tamper with it. DKIM is how your recipient's mail server verifies that the message arrived intact and actually came from you.
DKIM (DomainKeys Identified Mail) works by attaching a cryptographic signature to every email you send. Your mail server signs the message with a private key. You publish the matching public key in your DNS. When your message arrives at Gmail, Outlook, or any other inbox, their server retrieves your public key from DNS and uses it to verify the signature. If the math checks out, DKIM passes. If the message was tampered with in transit, the verification fails.
A few things DKIM proves:
- The message was signed by someone who controls the domain in the DKIM signature
- The message content hasn't been modified since it was signed
A few things DKIM doesn't prove: that the signing domain matches what your recipients see in the "From" address. That alignment check is DMARC's job.
DKIM works alongside SPF as part of the email authentication trio. SPF verifies the sending server. DKIM verifies the message content. DMARC connects them to the visible "From" address and sets policy. You really do want all three.
If you're using an ESP, they've almost certainly configured DKIM for you, usually by having you add a CNAME or TXT record to your DNS during setup. Not sure if yours is working? Check with our free DKIM checker.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
