What is DKIM (DomainKeys Identified Mail)?
DKIM is an email signature: the sending server signs each message with a private key, and the receiver checks it against a public key published in the sender's DNS.
Also called: DKIM signature.
A DKIM signature proves two things: that the message was sent by someone who controls the signing domain's key, and that the signed parts of the message were not changed in transit. It does not on its own say the domain is trustworthy; that is sender reputation.
The public key lives at selector._domainkey.yourdomain.com, where the selector is a name chosen by the sending service. Google Workspace uses the selector google by default and Microsoft 365 uses selector1 and selector2. Each sending tool that sends as your domain needs its own key or must sign through your provider.
DKIM is one of the requirements in Google's guidelines for senders of more than 5,000 messages a day to Gmail, alongside SPF and a DMARC record, and DMARC passes when either SPF or DKIM passes and aligns with the From: domain. Because DKIM survives forwarding better than SPF, it is usually the one that carries alignment.
To check a key, enter your domain and selector in the SPF, DMARC and MX checker.