DKIM (DomainKeys Identified Mail)
DKIM is an email authentication standard that attaches a cryptographic signature to every message, letting the receiving server verify the mail really came from your domain and wasn't altered in transit.
How DKIM works
When you enable DKIM, your sending platform signs each outgoing message with a private key. The matching public key lives in a TXT record on your domain's DNS. The receiving mail server looks up that public key, checks the signature, and confirms two things: the message was authorised by your domain, and its signed content wasn't changed on the way.
A valid DKIM signature is one of the strongest signals a mailbox provider uses to decide whether to trust — and inbox — your mail. Without it, messages are far more likely to be filtered to spam or rejected outright.
Why DKIM matters
- Proves your domain authorised the message, cutting spoofing and phishing in your name
- Detects tampering — any change to signed headers or body invalidates the signature
- Required for DMARC to pass by alignment, alongside SPF
- Directly improves inbox placement at Gmail, Outlook, Yahoo and every major provider
Setting up DKIM
You publish one (or two, for key rotation) CNAME or TXT records in your DNS that point to the public key your provider generates. Once DNS propagates, every message is signed automatically — there's nothing to do per campaign.
Gmail and Yahoo now require DKIM for bulk senders, so it's no longer optional if you send at any volume.
Frequently asked questions
Is DKIM the same as SPF?
No. SPF authorises which servers may send for your domain; DKIM cryptographically signs the message itself. They're complementary — you want both, plus DMARC on top.
Does DKIM stop all spam in my name?
It stops attackers from forging valid mail from your domain and, combined with DMARC, lets receivers reject spoofed messages. It doesn't filter inbound spam you receive.
What is a DKIM selector?
A selector is a short label in the DNS record name that lets one domain publish multiple DKIM keys — for example for different sending services or during key rotation.
Start sending in minutes
Create a free account, connect your domain and reach your audience across every channel — no credit card needed.
Free plan forever · No credit card required · Set up in minutes