What is DKIM (DomainKeys Identified Mail)?
DKIM (DomainKeys Identified Mail) is an email authentication standard that attaches a cryptographic signature to each message. Receiving servers use a public key published in your DNS to confirm the message really came from your domain and wasn't altered in transit.
How DKIM works
When you send mail, your server signs the message with a private key, adding a DKIM signature to the headers. You publish the matching public key as a DNS record. The receiving server fetches that public key and verifies the signature.
If the signature is valid, the receiver knows two things: the message genuinely originated from your domain, and its signed content wasn't tampered with along the way. If verification fails, the message is treated as suspicious.
Why DKIM improves deliverability
DKIM is the second pillar of authentication after SPF. Because it cryptographically ties a message to your domain, it's harder to forge than SPF alone, and mailbox providers weigh it heavily when deciding inbox placement.
DKIM also enables DMARC alignment, which lets you publish a policy telling receivers what to do with mail that fails authentication. Without DKIM, your DMARC protection is weaker.
DKIM as part of a healthy sending setup
Most email service providers configure DKIM for you when you authenticate your sending domain; your job is to publish the DNS record they provide. Once in place, DKIM requires little maintenance beyond occasional key rotation.
Combined with SPF, DMARC, and a verified recipient list kept clean with tools like Mailbeam, DKIM helps ensure your mail is trusted and delivered.
In practice
Your ESP signs every outgoing message with DKIM. A recipient's server retrieves your public key from DNS, validates the signature, and confirms the message is authentic and unmodified — a trust signal that, alongside SPF and DMARC, keeps your campaigns out of the spam folder.
Frequently asked questions
Verify emails with confidence
Mailbeam handles all of this for you — syntax, MX, SMTP, catch-all, and disposable checks in one API call. 1,000 free verifications/month, no credit card.