Definition

DKIM (DomainKeys Identified Mail) cryptographically signs outgoing email so receivers can verify the message was not altered in transit and originated from an authorized sender for your domain.

Detailed Explanation

Your email service adds a digital signature in the email header. Receivers look up your public key in DNS (CNAME or TXT on selector._domainkey.yourdomain.com) and verify the signature.

Unlike SPF (IP-based), DKIM survives forwarding better and proves message integrity.

Nepal Context

Mailchimp, Brevo, and SendGrid provide DKIM setup wizards — add their DNS records before your first campaign. Gmail and Outlook weigh DKIM pass heavily for inbox placement in Nepal.

Practical Examples

  • A company using Google Workspace generates a DKIM key in the admin console and adds the TXT record to its DNS.
  • A newsletter platform provides two CNAME records; once added, its emails are signed with the company’s own domain instead of the platform’s.

How to Check It

  1. Send a test email to Gmail, open Show original, and look for DKIM: PASS with your domain.
  2. Use an online DKIM lookup with your selector to confirm the public key is published.
  3. Re-check after changing email platforms or DNS providers.

Key Takeaways

  • DKIM = cryptographic proof of sender authenticity
  • Configured via ESP + DNS CNAME/TXT records
  • Check the Authentication-Results header for dkim=pass

Common Mistakes

  1. Not enabling DKIM signing in ESP after DNS setup
  2. Wrong selector in DNS record
  3. Rotating ESP without updating DKIM records