DKIM

What is DKIM?

DomainKeys Identified Mail

DomainKeys Identified Mail (DKIM) is a cryptographic signature added to outgoing email. The signing key's public half is published in DNS at `<selector>._domainkey.your-domain.com`. Receiving servers look up the public key, verify the signature, and know the message really came from a server authorized for your domain.

In more detail

DKIM is the cryptographic part of email authentication. SPF checks IPs, DKIM checks cryptographic signatures, DMARC sets the policy. DKIM is harder to spoof than SPF because it signs the actual message content — if any byte changes in transit, the signature fails.

Setup is provider-specific: your email service (Resend, Postmark, Google Workspace) gives you the exact TXT record to add. Each provider uses its own selector.

Why this matters

Why builders care

Gmail and Yahoo now require DKIM for bulk senders. Apps that send signups, password resets, or notifications need DKIM to avoid the spam folder. Every modern email service supports it out of the box.

See where your site stands

Paste a URL, get a score in 60 seconds. Free, no signup.