A signature on every message
DKIM signs each email with a private key; receivers verify it with a public key in your DNS. It proves the message wasn't tampered with in transit.
Selectors and keys
Your provider gives you a selector and a public key to publish as a TXT/CNAME record. Multiple selectors let you rotate keys safely.
Why it boosts trust
A valid DKIM signature ties the message to your domain cryptographically — far stronger than SPF alone, and required for a strong DMARC.
Key takeaway
DKIM is the tamper-proof seal that lets receivers trust the message really came from you.