What is a digital signature?

A digital signature is cryptographic proof that an email wasn't tampered with after the sender signed it. It works like a fingerprint that only the legitimate sender could have created. If someone changes even one character of a signed email (the subject line, a word in the body, an attachment), the signature breaks.

In email, digital signatures are how DKIM works. Your mail server uses a private key (kept secret on your server) to sign outgoing messages. The signature is added as a header. Receiving servers check the signature using your public key, which you publish in DNS. If the signature validates, the receiver knows two things: the message really came from your domain, and nobody changed it in transit.

Here's what gets signed: usually the From header, the To header, the Subject line, the Date, and the message body (or parts of it). Not every header gets signed, which is why spammers can still spoof the Reply-To field or add misleading X-headers. But the critical parts (who sent it, what they said) are locked in.

Why this matters: without digital signatures, anyone can send email claiming to be from your domain. With DKIM in place, mailbox providers like Gmail and Outlook can verify that your messages are legitimate. DKIM alone won't get you into the inbox (you still need good sender reputation), but without it, you're starting from a trust deficit. Most ESPs handle DKIM signing automatically. Mailchimp, SendGrid, Postmark, and others will sign on your behalf once you authenticate your domain. If you're running your own mail server or using a custom SMTP setup, you'll need to configure DKIM manually (which means generating a key pair, publishing the public key in DNS, and configuring your server to sign outgoing mail).

You can verify your DKIM setup is working with our free DKIM checker. Send a test email and check the headers to see if the signature validates. If it doesn't, that's usually a DNS publishing issue or a key mismatch.