DKIM
DomainKeys Identified Mail: a digital signature added to your outgoing email, checked against a key in your DNS, that proves the message is genuine and unchanged.
DKIM, or DomainKeys Identified Mail, adds a hidden digital signature to every email you send. The matching public key is published in your domain’s DNS. Receiving servers use the key to check the signature. If it matches, they know the message really came from your domain’s email service and wasn’t altered along the way.
Why it matters to a small business
DKIM is one of the main signals inboxes use to trust your email. Without it, messages are more likely to go to spam. It also makes DMARC work properly, because DMARC can rely on DKIM passing even when SPF fails, such as when mail is forwarded.
Each service that sends email for you, such as Microsoft 365, Google Workspace or a newsletter tool, needs its own DKIM setup. It’s often switched on in the service’s admin settings, then confirmed by adding one or two DNS records.
DKIM records are easy to lose when moving DNS to a new provider, because they have unusual names. It’s worth checking them after any DNS move.
Example
A real estate office uses Google Workspace. Its administrator generates a DKIM key in the Google admin console, adds the TXT record to DNS, and turns on signing. From then on, every email carries a signature that Gmail, Outlook and others can verify.
Learn more
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.