What Is DKIM?
DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to an email so a receiving system can verify which domain signed it and whether signed portions changed in transit.
How a DKIM signature works
The sending system signs selected message headers and content with a private key. The receiving system retrieves the matching public key from DNS and verifies the signature.
DKIM pass and fail
DKIM pass means the signature validated for the signing domain. DKIM fail can mean the message changed, the signature is broken, or the sender's configuration is incorrect. Missing DKIM simply means no usable signature was found.
The signing domain matters
The DKIM signing domain may not match the visible From domain. That can be normal for mailing providers. DMARC checks whether an authenticated SPF or DKIM domain aligns with the visible sender.
DKIM is not a safety guarantee
Attackers can sign mail from domains they control. A passing signature supports message integrity and domain authorization; it does not validate the sender's claims or requested action.
Check a suspicious email
Paste the message or full header into the local Email Analyzer to review technical warning signs.
Check an Email