What Is DKIM (DomainKeys Identified Mail)?

DKIM (DomainKeys Identified Mail) is an email authentication standard, defined in RFC 6376, that lets a receiving mail server verify that a message was genuinely authorized by the domain it claims to come from and was not altered in transit. It works with public-key cryptography: the sending server signs each outgoing message with a private key, adding a DKIM-Signature header, and publishes the matching public key as a DNS TXT record at a named selector under the sending domain (for example, selector._domainkey.yourdomain.com). Receiving servers fetch the public key and check the signature; a valid signature proves the domain owner authorized the mail and the signed content arrived unchanged. DKIM is one of the three core authentication protocols alongside SPF and DMARC, and since February 2024, Google and Yahoo require authentication for senders, making DKIM effectively mandatory for anyone doing cold email at volume.

DKIM (DomainKeys Identified Mail) in Practice

In practice, DKIM setup for cold email means enabling it in the email provider and publishing the DNS record they generate. In Google Workspace: Admin console, Apps, Gmail, Authenticate email, generate the key (2048-bit is standard), copy the TXT record into the domain's DNS, then turn signing on. Microsoft 365 has an equivalent flow requiring two CNAME records. Because cold email programs run many secondary sending domains, this must be repeated per domain - a program with 20 domains has 20 DKIM records, and each should be checked after setup with a tool like MXToolbox or by sending to a Gmail address and inspecting the message headers for dkim=pass. A concrete failure mode: a sender migrates email providers, forgets that the old DKIM record no longer matches the new signer, and the messages start failing DMARC alignment - deliverability sags with no change to lists or copy. The common misconception is that passing DKIM gets you to the inbox. Authentication is a floor, not a ranking boost: it proves identity so that reputation can be attached to the domain, and that reputation - not the signature itself - decides inbox versus spam.