What is DKIM?
DomainKeys Identified Mail — a cryptographic signature proving a message was not altered in transit.
Written by the SkyQon engineering team · Last verified 4 August 2026
Why it matters
DKIM proves a message genuinely came from your domain and was not altered on the way. SPF authorises servers; DKIM authenticates the mail itself, which is why a DKIM signature survives the forwarding that routinely breaks SPF.
The standard
RFC 6376 (2011). A public key is published in DNS at <selector>._domainkey.<domain>, and the matching private key signs outbound messages at your mail gateway.
Official text: RFC 6376
How it fails
Keys rotate, selectors are not updated, and signatures stop verifying — mail keeps flowing, so nobody notices until DMARC moves to enforcement and legitimate mail starts being rejected. Keys shorter than 2048 bits and test-mode flags (t=y) left in production both weaken the signature without visibly breaking anything.
Related terms
Check this on your own domain
SkyQon reads the same public signals described on this page and scores them for your domain. No account, no agent, nothing to install — a scored report by email in minutes.