What is DKIM (DomainKeys Identified Mail)?
DKIM (DomainKeys Identified Mail) is an email authentication standard that attaches a cryptographic signature to each message. Receiving servers use a public key published in your DNS to confirm the message really came from your domain and wasn't altered in transit.
How DKIM works
When you send mail, your server signs the message with a private key, adding a DKIM signature to the headers. You publish the matching public key as a DNS record. The receiving server fetches that public key and verifies the signature.
If the signature is valid, the receiver knows two things: the message genuinely originated from your domain, and its signed content wasn't tampered with along the way. If verification fails, the message is treated as suspicious.
Why DKIM improves deliverability
DKIM is the second pillar of authentication after SPF. Because it cryptographically ties a message to your domain, it's harder to forge than SPF alone, and mailbox providers weigh it heavily when deciding inbox placement.
DKIM also enables DMARC alignment, which lets you publish a policy telling receivers what to do with mail that fails authentication. Without DKIM, your DMARC protection is weaker.
DKIM as part of a healthy sending setup
Most email service providers configure DKIM for you when you authenticate your sending domain; your job is to publish the DNS record they provide. Once in place, DKIM requires little maintenance beyond occasional key rotation.
Combined with SPF, DMARC, and a verified recipient list kept clean with tools like Mailbeam, DKIM helps ensure your mail is trusted and delivered.
A DKIM signature, tag by tag
The signature travels in the message header. Each tag tells the receiver how to rebuild and check the hash.
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=example.com; s=s1; t=1718280000;
h=from:to:subject:date;
bh=uoq1oCgLlTqpdDX/iUbLy7J1Wic=;
b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSb...
d= signing domain - the identity being claimed
s= selector; the key lives at s1._domainkey.example.com
h= which headers are covered. Anything not listed here
can be altered in transit without breaking the signature
bh= hash of the body
b= the signature itselfOnly the headers named in the h= tag are protected by a DKIM signature, so any header omitted from that list can be modified in transit without invalidating it.
Sources
Checked against these sources on .
In practice
Your ESP signs every outgoing message with DKIM. A recipient's server retrieves your public key from DNS, validates the signature, and confirms the message is authentic and unmodified — a trust signal that, alongside SPF and DMARC, keeps your campaigns out of the spam folder.
Frequently asked questions
Verify emails with confidence
Mailbeam handles all of this for you — syntax, MX, SMTP, catch-all, and disposable checks in one API call. 1,000 free verifications/month, no credit card.