What is DKIM?

How does DKIM work?

DKIM is defined in RFC 6376. It lets the owner of a domain "claim some responsibility for a message by associating the domain with the message," and that claim "is validated through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key."

1. Your mail server signs the message's body and chosen headers with a private key.
2. It adds a DKIM-Signature header that names your domain (the d= tag) and a selector (the s= tag).
3. The receiver fetches the public key from DNS, under the selector in your domain's _domainkey subdomain, and checks the signature.

How is DKIM different from SPF?

Compared	SPF	DKIM
What it checks	The server that sent the message	A signature on the message
Where it lives	One TXT record on your domain	A public key per selector

Neither one checks the From address a person sees. DMARC does that, using the results of both.

Do you need DKIM for cold email?

Yes. Google tells every sender to Gmail accounts to "Set up SPF or DKIM email authentication for your sending domains," and requires both, plus DMARC, from senders of more than 5,000 messages a day. Every service that sends as your domain, from your mailbox provider to your CRM, should sign with its own DKIM key.

Check your domain

The free deliverability check looks up a domain's MX, SPF, DKIM and DMARC records in public DNS and explains each one. Dylan's deliverability is powered by Folderly.