DKIM
DomainKeys Identified Mail — cryptographic signature that proves an email genuinely came from the sender's domain.
DKIM (DomainKeys Identified Mail) is an email authentication method that cryptographically signs outgoing email with a private key. The sender publishes the matching public key as a DNS TXT record. Receiving servers verify the signature against the public key, proving (a) the email came from a server authorized for the sender domain and (b) the message wasn't altered in transit.
A DKIM signature lives in the email headers as a DKIM-Signature line. The signature covers specified header fields plus the message body. If anything changes — even a single character — the signature fails verification, and the receiver knows the message has been tampered with.
DKIM is half of the modern authentication stack (the other half is SPF). DMARC requires either SPF or DKIM (typically both) to pass, with the additional check that the authenticated domain aligns with the visible From: address. Without DKIM, you can't reliably pass DMARC, which since 2024 means your bulk email to Gmail/Yahoo will go to spam.