DomainKeys Identified Mail — a cryptographic signature added to emails and verified against a public key in DNS, proving the message came from your domain and was not altered.

SPF authorises sending servers by IP; DKIM signs the message itself and survives forwarding. They cover different gaps and are used together.

Does DKIM stop spoofing of the from address?

Not by itself — that is DMARC's role. DKIM proves message integrity and origin; DMARC aligns it with the visible from domain and sets a policy.

Growth Marketing Glossary

DKIM

DKIMnoun

A tamper-proof seal on every message — break it and receivers know the mail was forged or changed.

Schematic — DKIM signing and verification

Stands for: DomainKeys Identified Mail
Adds: a cryptographic signature
Proves: origin and integrity
Key published: in DNS

Forms & parts of speech

DKIM · noun

A cryptographic signature verifying an email's domain and integrity.

"A broken DKIM signature means the message was altered or spoofed."

How DKIM works

DKIM attaches a cryptographic signature to each outgoing message using a private key held by the sender. The matching public key is published in the domain's DNS for receivers to look up.

The receiving server verifies the signature against that public key. A valid signature proves two things: the mail genuinely came from the domain, and its key contents were not altered in transit.

Why it complements SPF

Where SPF authorises sending servers, DKIM authenticates the message itself and survives forwarding, since the signature travels with the email. The two cover different gaps in the same problem.

DKIM still does not directly protect the visible from address — that is DMARC's job. Together SPF, DKIM, and DMARC form the authentication stack that Google and Yahoo's 2024 rules require of bulk senders.

Worked example. Suppose a phisher copies a brand's email and changes the payment link before relaying it. Because the attacker cannot reproduce the brand's private key, the DKIM signature no longer matches the altered content, and receiving servers see the verification fail.

Genuine mail from the brand's own platform signs correctly and passes. That signature is what lets a mailbox provider tell the real message from a tampered copy.

Failure modes to watch. Publishing a weak or rotated-out DKIM key that fails verification; signing with a short key length that providers distrust; and assuming DKIM alone stops from-address spoofing, which needs DMARC.

Benchmarks

DKIM is a pass or fail authentication check. Track full coverage across SPF, DKIM, and DMARC rather than a single rate.

Mechanism

public-key signature

Survives

forwarding

Required by

Google/Yahoo 2024

Ranges are illustrative; every published figure is cited from a named public source or labelled “RGM analysis.”

Synonyms & antonyms

Synonyms

domainkeys identified mail

Antonyms

spoofing

Usage trends

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Common questions

What is DKIM?: DomainKeys Identified Mail — a cryptographic signature added to emails and verified against a public key in DNS, proving the message came from your domain and was not altered.
DKIM vs SPF?: SPF authorises sending servers by IP; DKIM signs the message itself and survives forwarding. They cover different gaps and are used together.
Does DKIM stop spoofing of the from address?: Not by itself — that is DMARC's role. DKIM proves message integrity and origin; DMARC aligns it with the visible from domain and sets a policy.

Related tools & calculators

Resources & people to follow

referenceGoogle & Yahoo bulk-sender requirements (2024)
referenceRFC 6376 — DomainKeys Identified Mail

Curated, non-competitor resources verified per term.

Sources

trendsGoogle Trends — "dkim"