Technology and tools
What is DKIM?
DomainKeys Identified Mail: a cryptographic signature added to email so receivers can verify the message came from the signing domain unchanged.
DomainKeys Identified Mail adds a digital signature to outgoing email headers. The signing domain publishes the public key in DNS, so any receiver can check that the message was signed by that domain and has not been altered in transit.
DKIM survives forwarding better than SPF. On its own it does not say whether the signing domain matches the visible From address, which is what DMARC alignment checks.