DomainKeys Identified Mail (DKIM)

DomainKeys Identified Mail (DKIM) lets a sending domain add a cryptographic signature to an email message.

Format
Email & Communication
Updated
Updated
Glossary Email & Communication
DomainKeys Identified Mail Also known as DKIM.Aliases: email signing.

Definition

DomainKeys Identified Mail (DKIM) lets a sending domain add a cryptographic signature to an email message.

How it works

The sending server signs each outgoing message with a private key, and receivers fetch the matching public key from your DNS to confirm the signed parts were not altered in transit. A valid signature proves which domain signed the message — it does not prove the mail is wanted, or that the From address your reader sees lines up with the signer.

Example: A mail service signs outgoing messages and publishes the matching public key in a DNS TXT record.

Often confused: SPF verifies the sending server's path, DKIM verifies a signature on the message itself, and DMARC checks that one of them aligns with the visible From address.

Sources

Last reviewed 2026-07-19.