DKIM

Email Marketing

Also: DomainKeys Identified Mail

What it doesProves an email wasn't altered in transit

HowA digital signature in the email header

Works withSPF and DMARC

Skip it andMail leans harder on spam filters

Quick definition

DKIM stands for DomainKeys Identified Mail. It's an email authentication method that adds a digital signature to outgoing emails, letting the receiving mail server verify the message genuinely came from your domain and wasn't altered in transit. It's set up as a DNS record.

How it varies across Australia

Most Australian businesses sending marketing email have SPF configured but a meaningful share still leave DKIM unsigned or misconfigured, especially on secondary sending domains. Gmail and Yahoo's bulk sender rules now make this a delivery problem, not just a best-practice checkbox.

See data and tracking scores across Australian industries →

What it actually means

Picture a signed letter versus an unsigned one. Anyone can type your name at the bottom of a page, but a proper signature is harder to fake and easy to check against a known sample. DKIM is that signature for email. Your mail server attaches a cryptographic signature to each outgoing message, and the receiving server checks it against a public key published in your Domain Name System (DNS) records. If the signature matches, the message hasn't been tampered with and genuinely came from your domain.

DKIM is one leg of the email authentication stool. Sender Policy Framework (SPF) checks whether the sending server is allowed to send on your behalf. DKIM checks the message content wasn't altered. Domain-based Message Authentication, Reporting and Conformance (DMARC) sits on top of both and tells receiving servers what to do if either check fails.

Without DKIM, your emails aren't automatically rejected, but they lose a trust signal that Gmail, Outlook and other providers weigh heavily when deciding between the inbox and the spam folder. This matters more now that bulk sender requirements have tightened. It also matters for deliverability metrics like open rate and bounce rate, which suffer quietly when authentication is weak.

DKIM doesn't get you into the inbox. It just stops mailbox providers assuming you're lying about who you are.

How it shows up

DKIM shows up as a DNS TXT record, usually with a selector prefix like 'selector1._domainkey.yourdomain.com'. Most email service providers generate this record for you and just need it pasted into your DNS. It also shows up in the raw email headers as a 'DKIM-Signature' field, which most people never see unless they're troubleshooting deliverability or reading full email headers during a spam complaint investigation.

The Australian context

Australian businesses sending marketing or transactional email through common local platforms often have DKIM available but not enabled by default, particularly when a domain is managed by a separate web hosting provider than the one sending the email. That handoff between hosting and sending is where most misconfigurations happen. It's also worth checking after any website migration, since DNS records get dropped during transfers more often than people expect.

Where people get this wrong

Assuming SPF alone is enough authentication.SPF only checks the sending server's permission. It says nothing about whether the message content was altered. DKIM and SPF cover different risks and both are expected by major mailbox providers.

Setting up DKIM once and never checking it again.DNS records get overwritten during domain transfers, hosting migrations and platform switches. A DKIM record that worked last year can silently disappear after an unrelated change.

Using a subdomain for sending without signing it separately.DKIM signatures are tied to the specific sending domain. If you send from a subdomain like mail.yourdomain.com, it needs its own DKIM record, not just inherited trust from the root domain.

DKIM vs SPF

	DKIM	SPF
What it checks	Whether the message content was altered	Whether the sending server is authorised
Set up as	DNS TXT record with a public key	DNS TXT record listing allowed servers
Breaks on forwarding?	Usually survives forwarding	Often breaks when email is forwarded
Works alone?	Stronger paired with SPF and DMARC	Stronger paired with DKIM and DMARC

Common questions

Do I need DKIM if I already have SPF set up?

Yes. SPF and DKIM check different things. SPF verifies the sending server is authorised, DKIM verifies the message wasn't altered. Major mailbox providers expect both, and DMARC needs at least one of them passing to function properly.

How do I set up DKIM?

Your email service provider generates a DKIM key and gives you a DNS TXT record to add. Log into your domain's DNS settings, usually through your host or registrar, paste the record in, and wait for it to propagate. Most platforms have a verification check once it's live.

Will DKIM guarantee my emails land in the inbox?

No. DKIM is one of several trust signals mailbox providers weigh alongside sender reputation, engagement history and content. It removes a red flag rather than adding a green light. Skipping it makes everything else harder.

Can DKIM break without me changing anything?

Yes. Domain transfers, hosting migrations and DNS provider changes can drop or overwrite the DKIM record without warning. It's worth checking DKIM status after any change to your domain's DNS settings, not just when setting it up initially.

Debrief

Get the next one

No spam. No fluff. Just the next article, straight to your inbox.

Keep exploring

About New Rebellion

New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.

How we think →