DKIM: sign your email so the recipient knows it's real

SPF checks which server sent a message. DKIM checks something else: whether the content is exactly what the sender actually wrote. That makes DKIM the protection that holds up even when a message gets forwarded through several systems before reaching the recipient, something SPF often can't handle.

What DKIM actually does

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message's header, created with a private key only your mail server holds. The public key sits in a DNS record. The receiving server recalculates the signature and compares it, if it matches, the message wasn't forged or altered on the way.

How to turn it on

You don't create the DKIM key yourself, you enable it in your email platform and publish what it gives you:

1. Microsoft 365: enable custom domain DKIM in the Exchange admin center (or via Enable-DkimSigningConfig in PowerShell). The service gives you two CNAME records (selector1._domainkey and selector2._domainkey) to add to DNS.
2. Google Workspace: generate the key under Admin console → Gmail → Authenticate email, publish it as a TXT record, then activate it in the same view.
3. Wait for DNS propagation (up to 48 hours, often much faster) before switching signing on for real.
4. Send a test message to a service like mail-tester.com and confirm DKIM shows pass, not just that the record exists.

Why it matters beyond SPF

Forwarding a message changes the sending server, and SPF, which only checks the server, often fails at that point. The DKIM signature sits inside the message itself and travels with it, as long as the content isn't altered on the way. That's the main reason to run both, not choose one over the other.