DKIM (DomainKeys Identified Mail)

Your mail provider signs each outgoing message with a private key and adds the signature in a DKIM-Signature header. The matching public key is published in DNS under a selector, at a name of the form selector._domainkey.yourdomain.com. The receiving server reads the selector from the signature, fetches the key and checks that the signed parts of the message, including the From header and the body, have not changed on the way.

Each service that sends as your domain needs its own DKIM setup: your mailbox provider, your marketing tool and any outbound platform. Providers document their own selectors and record types; some publish a TXT record with the key, others ask for CNAME records that point to keys they rotate for you. A message signed with your own domain's key is what lets DKIM count towards DMARC, so signing with the provider's shared domain is not enough for outbound.

Sources: RFC 6376 (DKIM) (rfc-editor.org, checked oct 22, 2026).