DomainKeys Identified Mail (DKIM) attaches a digital signature to every email you send, letting the receiving server confirm the message actually came from you and wasn't altered along the way.
DKIM works through a pair of cryptographic keys: a private key your mail server uses to sign every outgoing message, and a public key published in your DNS as a TXT record. When a message arrives, the receiving server retrieves your public key and uses it to verify the signature matches.
If it matches, the receiving server knows two things: the message really did come from a server you authorized, and nothing in it, headers or body, was changed in transit. Unlike SPF, which authorizes servers, DKIM authenticates the message itself.
We generate a private and public key pair specific to your domain and mail sending setup.
The public key is published as a DNS TXT record under a selector unique to your domain, so it doesn't conflict with other senders.
Your mail server signs each outgoing message with the private key, adding a DKIM-Signature header before it's sent.
The receiving server checks the signature against your public key. A mismatch or missing signature feeds into your DMARC policy.
SPF only checks whether the sending server was authorized; it says nothing about whether the message itself was tampered with after it left that server. DKIM fills that gap, and it's the other half of the foundation DMARC needs to function properly.
Our team will generate your keys, publish the correct DNS records, and confirm your signatures validate properly, as part of a complete authentication strategy alongside SPF and DMARC.
MDA Insights helps businesses lock down their email domains against spoofing, phishing, and impersonation with SPF, DKIM, and DMARC configured right the first time, and monitored so they stay that way.
2026 MDA Insights - All Rights Reserved.