DKIM signs content and survives forwarding; SPF is simpler but tied to IPs. Deploy both, then enforce with DMARC.
What DKIM signing is#
DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.
Why it matters#
DKIM survives forwarding where SPF breaks, carries domain reputation across sending IPs, and is the most reliable path to DMARC alignment for third-party senders.
How SPF differs#
SPF solves an adjacent problem. DKIM signs content and survives forwarding; SPF is simpler but tied to IPs. Deploy both, then enforce with DMARC. In practice the two are deployed together and monitored with the same reporting.
Which to implement first#
Start with whichever your sending platform makes easiest, then add the other. Deployment order matters less than reaching a state where both pass and align with your From domain.
Frequently asked questions#
What is a DKIM selector?
A label that lets one domain publish multiple keys. The selector appears in the s= tag and forms the DNS name selector._domainkey.domain.
Why does DKIM pass but DMARC fail?
Alignment. DMARC requires the d= domain to match the From header domain. If your vendor signs with their own domain, set up a custom DKIM domain with them.
Can I use one DKIM key for all my ESPs?
You can publish separate selectors per vendor. Never share private keys between platforms.