What is DKIM?
Also called: DomainKeys Identified Mail, DKIM signature
DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to outgoing email using a private key, with the matching public key published in DNS. A receiving server checks the signature to confirm the message was sent by an authorised domain and was not altered in transit.
The public key lives at a selector-specific hostname, selector._domainkey.example.com, which is why checking DKIM means knowing the selector. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2, and most sending platforms use their own.
DKIM usually survives forwarding where SPF does not. When a message is forwarded the sending IP changes and SPF breaks, but the signature still validates as long as the signed content was not changed.
A signature that fails is a problem, not a neutral result: it can mean the key was rotated without updating DNS, or that something in transit rewrote the message. Google requires DKIM from bulk senders.
Example
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."Go deeper
Sources
By SimpleVerifier Team · Last reviewed 2026-10-13 · All 50 glossary terms