DKIM (DomainKeys Identified Mail)
A signature on each message, checked against a public key in your DNS.
Your sending service signs messages with a private key; receivers fetch the public key from DNS under a selector name and verify the message was not changed. Unlike SPF, DKIM survives forwarding. 2048-bit RSA keys are the current norm.
Related terms
- SPF (Sender Policy Framework): A DNS record listing which servers may send email for your domain.
- DMARC: The policy that tells receivers what to do when mail fails SPF and DKIM, and where to report.
