DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. The sending server signs selected headers and the body with a private key, and adds the result as a DKIM-Signature header. The receiving server looks up the matching public key in your DNS and checks the signature. If it matches, the receiver knows the message was signed by someone holding the key for that domain and that the signed parts weren’t changed on the way.
The public key lives in a DNS TXT record at a name made from a selector and your domain, for example selector._domainkey.yourbrand.com. The selector lets one domain have many keys at once: one for your email platform, another for your helpdesk, another for Google Workspace. Each service signs with its own key, and you can retire one without touching the others. Some services publish the key through a CNAME instead, so they can rotate it themselves.
For DMARC, what matters is the d= domain in the signature. If an email platform signs with its own domain rather than yours, DKIM passes but doesn’t align with your From address, and DMARC can’t use it. Setting up DKIM on your own domain with each service that sends for you is what makes DMARC pass reliably. Use 2048-bit keys where your DNS provider supports them; 1024-bit is an older minimum.
DKIM usually survives forwarding, which is an advantage over SPF, but it breaks if something along the way changes the signed content. Mailing lists that add footers and security gateways that rewrite links are common culprits. Typos when pasting long keys into DNS, and keys split incorrectly across strings, are the most frequent setup errors.
A Mysuru sandalwood brand adds its domain to its email platform and receives a DKIM record to publish. It pastes the key into its DNS panel, waits 20 minutes and clicks verify. From then on, campaigns carry a DKIM signature with d=mysurusandal.in, which lines up with its From address for DMARC.
MailNesto creates a 2048-bit DKIM key for each sending domain you add, shows the exact DNS record to publish, checks that the published key matches and signs your emails once the domain is verified.