DKIM (DomainKeys Identified Mail) — DomainKeys Identified Mail
What is DKIM (DomainKeys Identified Mail)?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to an outgoing email, generated with a private key, that a receiving mail server verifies against a public key published in the sending domain's DNS — proving the message wasn't altered in transit and genuinely originated from an authorized sender. Unlike SPF, which checks the sending server's IP address, DKIM verifies the message content itself, which is why it survives email forwarding better than SPF does.
More detail
A DKIM signature covers specific message headers and the body, so any tampering with the message content after signing invalidates the signature during verification at the receiving end.
Because DKIM verifies the message itself rather than the sending server, it remains valid even after a message is forwarded through an intermediate server, unlike SPF's IP-based check.
Frequently asked
- What's the difference between what SPF and DKIM each check?
- SPF checks whether the sending server's IP address is authorized for the domain; DKIM checks whether the message content itself is signed by and matches a key published by the domain, verifying integrity rather than just the sending source.
- Why does DKIM survive forwarding better than SPF?
- DKIM's cryptographic signature travels with the message content itself and can be verified regardless of which server relayed it, while SPF checks the immediate sending server's IP — which changes to the forwarding server's IP once a message is forwarded, often causing SPF to fail.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.