Also called: DomainKeys Identified Mail
DKIM is an email authentication method that attaches a cryptographic signature to outgoing mail, letting the receiving server confirm the message came from the claimed domain and wasn't altered after it was sent.
DKIM works by signing, not by listing. A sending domain publishes a public key in DNS, and every outgoing message gets a private-key signature attached to it. The receiving server pulls the public key and checks the signature against the message. If they match, the receiver knows two things: the domain actually sent it, and nothing changed in transit. SPF only answers the first question. DKIM answers both.
A valid DKIM signature proves identity and integrity. It says nothing about content quality, spam likelihood, or where the message will land once it's judged trustworthy. A perfectly signed message from a domain with no sending history and no engagement behind it can still land in spam, because DKIM answers a different question than the one that actually decides inbox placement.
Since February 1, 2024, Google requires SPF or DKIM at minimum from any sender, and both together, plus a published DMARC record, once a sender crosses 5,000 messages a day to Gmail addresses. Yahoo's bulk-sender guidance asks for the same baseline. Most cold-outbound programs cross that daily volume faster than expected once several mailboxes are running at once, which is why DKIM gets set up at domain launch rather than retrofitted after a problem shows up.
DKIM gets configured once per sending domain, as a DNS TXT record holding the public key, set up alongside SPF and DMARC before the first real send. Rotating the key periodically is good hygiene, but for most cold-outbound programs the bigger risk is never publishing one at all on a newly added domain.
The common assumption is that a signed, authenticated message is a message that will land in the inbox. It isn't. DKIM proves who sent something and that it wasn't tampered with. It has no opinion on sending volume, recipient engagement, or list quality, which are the factors that actually decide where a fully authenticated message ends up.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us