What is DKIM?

DKIM (DomainKeys Identified Mail)is an email-authentication standard that attaches a cryptographic signature to every message you send. The receiving server uses your public key — published in DNS — to verify the signature, proving the message really came from your domain and wasn’t altered in transit.

How DKIM works

Your mail server signs each outgoing message with a private key and adds a DKIM-Signature header. The matching public key lives in a DNS TXT record at a selector subdomain:

selector1._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq...AB"

The receiver fetches that key, re-computes the signature over the message body and headers, and records a pass or fail. A pass means the content is intact and authentic.

Why it matters

DKIM works with SPF and DMARC to keep your email out of spam and prevent spoofing. A broken DKIM key — common after rotating keys or switching email providers — silently tanks deliverability. Sending a test message to a Devmailr inbox surfaces the DKIM verdict so you catch it in CI; see testing SPF, DKIM, and DMARC.