DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.
What is a DKIM selector?
A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.
Why does DKIM pass but DMARC fail?
Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.
Can I use one DKIM key for all my ESPs?
You can publish separate selectors per vendor. Never share private keys between platforms.
Why does DKIM signing matter for deliverability?
DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.
What is the first step to get started with DKIM signing?
Generate a 2048-bit key pair in your ESP or mail server (1024-bit keys are considered weak).
What is the most common DKIM signing mistake?
Signing with the ESP's domain (d=esp.com) instead of yours, which passes DKIM but fails DMARC alignment.