DKIM
Also known as: DomainKeys Identified Mail, Email DKIM Signature
DKIM is an email authentication standard that cryptographically signs outbound mail so receivers can verify it really came from your domain.
Definition
DKIM (DomainKeys Identified Mail) is an authentication protocol that adds a cryptographic signature to every email your domain sends. Receiving mail servers check that signature against a public key published in your DNS to confirm the message wasn't forged or tampered with in transit.
In practice, your sending platform signs each outbound message with a private key, and inbox providers like Gmail and Outlook look up the matching public key in your DNS to validate it. A passing DKIM check is one of the core signals that keeps your campaigns out of spam and qualifies you for stricter sender requirements at major providers.
DKIM is one leg of a three-part authentication stack alongside SPF (which lists authorized sending IPs) and DMARC (which tells receivers what to do when SPF or DKIM fails). All three work together — DKIM alone isn't enough, and skipping it puts your domain at real deliverability risk.
Why It Matters
Without DKIM, your outbound email is treated as untrusted by every major inbox provider, which means lower placement rates, more spam-folder routing, and eventually domain reputation damage that's hard to reverse. Gmail and Yahoo now require DKIM for any sender pushing more than a few thousand messages a day, and B2B filters increasingly reject unsigned mail outright.
When DKIM is misconfigured or missing, sales sequences stop landing, marketing campaigns underperform their open-rate benchmarks, and transactional mail (password resets, receipts) starts getting flagged. Worse, your domain becomes easier to spoof in phishing attacks, which can poison your reputation through no fault of your own and force a painful warm-up cycle on a new sending domain.
Examples in Practice
A 40-person B2B SaaS company launches a cold outreach sequence from a new subdomain. After two days, reply rates are near zero — a DNS audit reveals the DKIM record was never published, so Gmail silently routed everything to spam. Once the record is added and propagated, deliverability normalizes within 48 hours.
An e-commerce brand sends order confirmations from one ESP and marketing newsletters from another. Both platforms need their own DKIM selectors published in DNS (e.g., 'esp1._domainkey' and 'esp2._domainkey') so each service can sign mail under the same root domain without conflicts.
A marketing ops lead at a mid-market firm investigates a sudden drop in campaign open rates. The DKIM key had been rotated by the ESP, but the new public key was never updated in DNS — every signed message was failing validation. Republishing the key restored inbox placement the same day.