Skip to main content
Senddio glossary · DomainKeys Identified Mail

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication standard. It lets a receiving mail server verify two things: that a message was genuinely sent by an authorised server for the sender's domain, and that the contents have not been changed since the message was signed.

How DKIM works in plain English

When you send an email through a DKIM-signing server, the server adds a digital signature to the message header. That signature is generated using a private key that only your sending server has. The matching public key is published in your domain's DNS as a TXT record. When the recipient's mail server receives the message, it looks up the public key in DNS and verifies the signature. If the signature is valid, the recipient knows the message really came from your domain and was not tampered with.

Why DKIM matters

Without DKIM (and its companion standards SPF and DMARC), receiving mail servers cannot tell whether a message claiming to be from your domain actually is. The result is usually that your messages land in spam folders, or are rejected outright. DKIM is the single most important step you can take to keep transactional and marketing email deliverable.

What does a DKIM record look like?

A DKIM DNS record is a TXT record at a subdomain like selector1._domainkey.yourdomain.com. The value starts with v=DKIM1; and contains a long base-64 encoded public key. Most providers (including Senddio) generate the records for you and verify them automatically once you publish.

DKIM vs SPF vs DMARC

SPF checks the sending IP against the envelope-sender domain. DKIM verifies a signing-domain signature. DMARC passes when at least one passing SPF or DKIM identity aligns with the visible From domain; neither passing and aligned means DMARC fails.

Related terms
DMARC SPF
FAQ

DKIM — FAQ

DKIM is strongly recommended. Receiving providers set their own authentication requirements, especially for bulk senders. Configure SPF, DKIM and DMARC and consult the receiving provider’s current sender guidelines.

Publish the records shown in your dashboard and recheck verification. DNS caches and TTLs affect when receivers see the records; there is no fixed propagation deadline.

Yes, and it is normal. Each key uses a different selector (the prefix before _domainkey). You might have one for your transactional provider and another for your marketing provider. Both can sign the same domain.

Senddio generates the DNS records for your sending configuration. Publish all records shown, including the selectors needed by each mail server, then check verification in Domains. Senddio does not edit your DNS automatically.

Senddio handles the boring parts of DKIM for you.

Try all six channels within Free safety caps, plus 20 monthly AI credits. Feature access depends on your plan. No card to start.

Start free Read the docs
● 300 emails/day · All 6 channels · AI credits · No card