DKIM
Also known as: DomainKeys Identified Mail
DKIM adds a cryptographic signature to outgoing email so the recipient can verify the message was not altered in transit.
DKIM (DomainKeys Identified Mail) signs every outgoing message with a private key held by the sending mail server. The matching public key sits in the domain's DNS. The receiving server fetches that key, checks the signature and learns two things: that the message really passed through an authorised server of this domain, and that headers and content have not been changed since.
Unlike SPF, which depends on the sending server's IP address, a DKIM signature survives ordinary forwarding — for instance when a recipient automatically relays mail to another mailbox. That is exactly why the two mechanisms complement each other instead of replacing one another.
The most frequent failure is a key rotation at the provider where the DNS record is not updated: the signature exists but cannot be verified, which is worse than no signature. Equally common: only the main mail server signs, while newsletter and invoicing systems send unsigned — so protection is missing precisely for the mail most likely to be forged.
What it means in practice
If mail from the ERP or newsletter tool is delivered worse than mail from Outlook, the DKIM signature is usually missing there. NDVDL sets up signing for every sending system, not just the main mailbox; the email check shows in advance which selectors are publicly discoverable.
Is this handled properly at your site?
We look at how it actually stands with you — and say honestly whether anything needs doing.
Related terms
All termsA term from your quote missing here?
Send us the passage you do not follow. We will explain it — with no obligation to order anything.