← Back to blog
Glossary · DKIM
What is DKIM?
DKIM confirms a message was not altered in transit and that a domain authorized it. It does not check the address a reader actually sees.
1 min read · Updated August 2026
DKIM is a cryptographic signature added to an outgoing message that lets the receiving server confirm the message was not altered in transit and that the domain named in the signature, the d= domain, actually authorized it. It does not check the visible From address; that is DMARC's job, one layer up.
The signature is verified against a public key published in DNS at a selector-specific host, <selector>._domainkey.yourdomain.com. A message can carry a perfectly valid DKIM signature and still be spoofed in the part a reader actually sees, because DKIM's authenticated identifier is the d= domain in the signature, not the From header a recipient reads. That gap is exactly what DMARC alignment exists to close.
DMARC's pass condition depends on this distinction directly: SPF or DKIM must not just pass, but align with the visible From domain.