What Is DKIM (DomainKeys Identified Mail)?

DKIM (DomainKeys Identified Mail) is an email authentication protocol that allows a sending domain to digitally sign outgoing messages, enabling receiving servers to verify that the email was genuinely sent by the domain owner and that its content was not altered in transit. DKIM works through public-key cryptography — the sending server signs each email with a private key, and the receiving server verifies the signature using a public key published in the domain's DNS records. When a DKIM-signed email is sent, the sending server generates a cryptographic hash of specified email headers and body content, then encrypts that hash with the domain's private key. This encrypted hash (the DKIM signature) is added to the email as a header. When the receiving server processes the email, it retrieves the public key from the sender's DNS (found at a selector-specific subdomain like s1._domainkey.yourdomain.com), decrypts the signature, and compares the result against its own hash of the received message. If they match, DKIM passes — proving both authenticity and integrity. DKIM is critical for B2B email deliverability because it provides a verifiable chain of trust. Google, Microsoft, and other major email providers heavily weight DKIM results in their spam filtering algorithms. An email that passes DKIM verification carries a trust signal that says the domain owner actually sent it and no one tampered with it between sending and delivery. For cold outreach, where you have no prior relationship with the recipient, this trust signal can make the difference between inbox placement and the spam folder. Key DKIM considerations include key length (2048-bit keys are now the standard, replacing older 1024-bit keys), key rotation (security best practice is to rotate keys every 6-12 months), and selector management (each email service provider typically uses its own DKIM selector). When using multiple sending services — a common scenario for outbound teams using separate platforms for warmup, cold outreach, and transactional email — each service needs its own DKIM selector configured in DNS. Prospect AI ensures proper DKIM alignment across all sending infrastructure as part of its email deliverability management, verifying that signatures are correctly configured for each sending domain and alerting teams when authentication issues arise.