DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email, letting the receiving mail server verify the message genuinely came from your domain and wasn’t altered in transit.
How it differs from SPF
SPF checks which servers are allowed to send for your domain; DKIM checks that this specific message is authentic and unmodified, using public-key cryptography. They’re complementary, not interchangeable — most modern deliverability guidance requires both.
Setting it up
- Your email provider generates a public/private key pair
- You publish the public key as a DNS TXT record (usually at a selector-based subdomain like
selector._domainkey.yourdomain.com) - The provider signs outgoing mail with the private key automatically
FAQ
Do I need DKIM if I already have SPF set up?
Yes — SPF alone is easily bypassed in certain forwarding scenarios; DKIM (and ultimately DMARC, which relies on both) meaningfully closes that gap.