Authentication

DKIM (DomainKeys Identified Mail)

A cryptographic signature added to outgoing email that lets receiving servers verify the message really came from your domain and wasn’t altered in transit.

How DKIM works

The sending server signs selected headers and the body of each message with a private key, and adds the result as a DKIM-Signature header. The header names the signing domain (d=) and a selector (s=).

The receiver looks up the public key at selector._domainkey.yourdomain.com, checks the signature, and confirms nothing was changed after signing. A valid signature proves the signing domain approved the message.

Why DKIM matters more than SPF

DKIM survives forwarding, because the signature travels with the message instead of depending on which server delivered it. That makes it the more reliable half of DMARC alignment, especially for mail that passes through mailing lists or forwarding rules.

Good DKIM practice

Use 2048-bit keys. 1024-bit keys still work but are increasingly considered weak.
Sign with your own domain, not your provider’s, so the signature aligns with your From address for DMARC.
Rotate keys periodically. Publish a new selector, switch signing to it, then retire the old one.
Give each sending service its own selector, so you can revoke one without touching the others.

DKIM and MailCraft

Every domain you add to MailCraft gets its own DKIM key. We give you the DNS record to publish, verify it, and sign every email from that domain, so signatures align with your From address from the first send.

Let MailCraft handle the details

Authentication, bounces, complaints and suppression are built in. Start free with 3,000 emails a month, no credit card required.

Start free

Related terms

Full glossary