DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. When your ESP sends an email, it signs the message with a private key. The receiving mail server retrieves the corresponding public key from your DNS and verifies the signature. If the signature is valid, the server confirms two things: the email was sent by someone with access to your private signing key (authentication), and the email content was not modified in transit (integrity). From a practical standpoint, DKIM solves a specific problem: email headers can be spoofed. Without DKIM, any server can claim to send email from yourdomain.com. DKIM cryptographically proves that the server sending on your behalf is the one you've authorized, because only it holds the private key. This is why DKIM is one of the three required DNS records (alongside SPF and DMARC) that Gmail and Yahoo now require for bulk senders. Setting up DKIM with your ESP: your ESP generates a public/private key pair and gives you a CNAME or TXT record to add to your DNS under a selector subdomain (typically something like k1._domainkey.yourdomain.com). Once the record propagates, every email sent through your ESP is signed automatically. DKIM key length matters: 1024-bit keys are the minimum; 2048-bit is recommended. Some legacy DNS providers don't support DKIM records over 255 characters without splitting — your ESP's support documentation will note if your provider requires the record split into chunks. DKIM signing covers specific email headers and the body hash, not the entire message. The signed headers typically include From, To, Subject, Date, and Content-Type. If any of these headers are modified in transit (by a spam filter, DMARC enforcement, or a relay server), the signature fails. This is why forwarded emails frequently fail DKIM — the forwarding server may modify headers or body content, breaking the signature. DMARC's relaxed alignment mode accommodates some of this by matching the signing domain against the From domain at the organizational level rather than requiring exact match. Practical verification: after setting up DKIM with your ESP, send a test email to a Gmail address and open the original message headers (View original in Gmail). Find the DKIM-Signature header and confirm the d= value matches your sending domain and the s= selector matches what your ESP configured. A status of 'PASS' next to 'dkim=' in the Authentication-Results header confirms the signature is being verified correctly. This check takes two minutes and is more reliable than waiting for deliverability problems to surface in your send metrics.