Email Marketing
What Is DKIM?
What this guide covers
- What the DKIM signature proves
- How selectors and DNS public keys fit together
- What happens when verification fails
- Why DKIM alignment matters for DMARC
The Simple Definition
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving mail server checks that signature against a public key published in your domain's DNS. If it matches, the server knows two things: the email genuinely came from your domain, and its content wasn't tampered with in transit.
How the Signing Actually Works
DKIM uses a key pair — a private key that stays on your mail server and signs outgoing messages, and a public key published in DNS that anyone can use to verify that signature. This is standard public-key cryptography, the same principle behind HTTPS.
The DKIM Flow, Simplified
Why DKIM Matters for Deliverability
Gmail, Yahoo, and other major providers factor DKIM verification directly into their spam filtering and, since 2024, into mandatory requirements for anyone sending meaningful email volume. Without it, your emails are significantly more likely to be filtered to spam regardless of how good your content is.
DKIM Selectors
You'll often see a "selector" mentioned alongside DKIM — this is just a label (like default or google) that lets a domain have multiple DKIM keys active at once, for example one for your main mail server and one for your email marketing platform.
Frequently Asked Questions
No. DKIM proves authenticity and integrity — that the email came from you and wasn't altered — but it doesn't encrypt the email content itself, which remains readable in transit.
A failed DKIM check is one of the signals mail providers use for spam filtering. Combined with DMARC, a failure can result in the message being rejected or sent to spam, depending on your policy.
Yes, using different selectors. For example, you might use one key for your main business email and a different one for your email marketing platform, both under the same domain.
Quick Summary
- DKIM adds a cryptographic signature to outgoing email to prove authenticity and integrity
- It uses a private key to sign and a public DNS-published key to verify
- Major providers factor DKIM into spam filtering and bulk-sender requirements
- Selectors let a domain run multiple DKIM keys for different sending sources
Sources & references
Primary and authoritative references used when preparing or reviewing this article. Product features, policies and standards can change, so verify current requirements before making production changes.
Runs PowerMTA.in alongside his own email marketing and affiliate operations targeting Indian audiences — hands-on with bulk sending infrastructure, live campaigns, and content properties. Read more →