DKIM

DKIM, short for DomainKeys Identified Mail, is an email authentication standard that attaches a cryptographic signature to outgoing messages so receiving mail servers can verify that a message genuinely came from the domain it claims and that its contents were not altered in transit. It is one of the core technical safeguards that let mailbox providers distinguish legitimate mail from forged or tampered messages, and it works quietly in the background of nearly every professionally run email program.

The mechanics rely on public-key cryptography. The sending organization generates a matched pair of keys: a private key kept secret on the sending server, and a public key published in the domain's DNS records for anyone to read. When an email is sent, the server uses the private key to create a unique signature based on the message headers and body, and it stamps that signature into the email's hidden header data. When the message arrives, the receiving server looks up the sender's public key in DNS, uses it to check the signature, and confirms two things: that the signature could only have been produced by the holder of the private key, and that the signed parts of the message were not changed along the way. If either check fails, the message is treated with suspicion.

The standard was introduced in 2004, formed by merging two earlier proposals, DomainKeys from Yahoo and Identified Internet Mail from Cisco. The combined name reflects that heritage: it uses domain-based keys to produce identified mail. It arose because the original email protocols were built for a small, trusting network and had no way to prove who actually sent a message, a gap that spammers and phishers exploited freely. DKIM added a verifiable identity layer without requiring the entire email system to be rebuilt.

For a business, DKIM matters because it directly affects whether email reaches the inbox and whether the brand can be impersonated. Mailbox providers factor authentication results into placement decisions, so properly signed mail is more likely to be trusted and delivered, while unsigned mail is more likely to be filtered. Just as importantly, DKIM makes it far harder for bad actors to send convincing fake email from a company's domain, protecting both customers and the brand's reputation from phishing and spoofing attacks. It is a low-cost, high-value piece of infrastructure that pays off in deliverability and security.

The most common mistake is misconfiguring the DNS records, which silently breaks the signature and can hurt deliverability without any obvious error message. Rotating or changing sending platforms without updating keys causes the same problem. Another nuance is that DKIM alone does not tell a receiver what to do when a check fails; it only provides the verification result. That is why it is designed to work alongside the two related standards it is usually paired with. One specifies which servers are allowed to send for a domain, and the other sets the policy that tells receivers how to handle failures and provides reporting. Together these three form the backbone of modern email authentication, and DKIM's contribution is the cryptographic proof of origin and integrity that the others build upon.