Your email passes through a dozen strangers' hands.Between your send button and someone's inbox, your email passes through a dozen machines you don't control. Any one of them could, in theory, quietly change a word. So how does the receiving server know your message arrived intact, and actually came from you? That's DKIM.
⬡ journey-flow, envelope hops across several relay nodes, a little wax-seal icon riding on topDKIM stands for DomainKeys Identified Mail. It works by attaching a cryptographic signature to every email you send. Think of it like a wax seal on a letter. Your server presses the seal on the way out. The receiver checks the seal on the way in.
⬡ dissect, a letter with a glowing wax seal, label "DKIM signature"Private key signs. Public key verifies.Here's the clever part. Your mail server signs the message with a private key, a secret that never leaves your server. Then you publish the matching public key out in the open, in your DNS. When your message lands at Gmail or Outlook, their server grabs your public key and checks the signature against it. If the math checks out, DKIM passes.
⬡ auth-flow, LEFT server signs with a private key, DNS holds the public key, RIGHT receiver verifies, green PASSSo what does a passing signature tell you? Two things. One, the message was signed by someone who controls that domain. Two, the content wasn't changed since it was signed. If a relay tampers with it in transit, the seal breaks and DKIM fails.
⬡ split-compare, LEFT "Untouched, seal intact, PASS" vs RIGHT "One word changed, seal broken, FAIL"If the wax-seal idea just clicked, subscribe. We're walking through every piece of email authentication, one question at a time.
⬡ title-card, subscribe nudgeOne honest limit. DKIM proves the signing domain, not the From address your reader actually sees. A scammer could sign their own lookalike domain perfectly. Lining up the signature with the visible From name is a different job, that's DMARC's, linked below. And authentication proves who you are, it does not guarantee you land in the inbox. Placement is a separate story.
⬡ record-cards, three cards: "Signed by the domain" check · "Content untampered" check · "Matches visible From, that's DMARC" arrow outSo DKIM is the wax seal on your mail. You sign with a private key, publish the public one in DNS, and receivers verify the message arrived exactly as you sent it. One piece of a trio: SPF checks the server, DKIM checks the message, DMARC ties it to the name people see. You really do want all three.
⬡ title-cardNext up, why this one signature moves the needle on your deliverability. And subscribe for the rest of the authentication playbook.
⬡ end-card, Subscribe + Next: "Why DKIM matters for deliverability" (003.002.002)What is DKIM? DomainKeys Identified Mail attaches a cryptographic signature to every email you send, so the receiving server can prove your message arrived intact and actually came from your domain. In under three minutes: the wax-seal analogy, how the private key signs and the public key (published in your DNS) verifies, the two things DKIM proves, and the one thing it does NOT (that's DMARC's job).
DKIM is one third of the authentication trio: SPF checks the sending server, DKIM checks the message content, DMARC ties both to the visible From address.
Next: Why DKIM matters for deliverability → [link 003.002.002]
Check whether your DKIM is working → reviewmyemails.com/tools/email-headers
Full written guide → reviewmyemails.com/emailalmanac/authentication/dkim/what-is-dkim
#email #dkim #deliverability