What is DKIM Signing?
Cryptographic email signing where the sender attaches a signature header verified against a DNS-published public key. Passing DKIM proves the message survived transit unmodified and truly came from the domain holder.
Example
The project generates a DKIM key pair, publishes the public key as a DNS TXT record, and signs every receipt. Inbox providers verify the signature on arrival and treat intact mail as genuinely from the domain.
What people get wrong
Signing with weak keys or forgetting rotation after staff changes. Key hygiene matters as much as the signature itself.
Related terms
SPF Record
A DNS TXT entry naming the mail servers allowed to send for a domain, checked against the envelope sender. Receivers distrust or reject mail from unlisted servers, so publishing SPF is step one of authentication.
DMARC Policy
A DNS rule telling receivers how to treat mail that fails SPF and DKIM alignment: monitor, quarantine, or reject. Published reports then reveal exactly who sends as your domain, legitimate or not.
Sender Identity
The verified domain or address a provider is permitted to send from, proven through DNS records. BYOB projects verify sending domains before campaigns so transactional mail leaves from a trusted name.
Return-Path Alignment
Matching the envelope sender domain used for SPF with the visible From domain that recipients see. Aligned domains let inbox providers credit authentication to the brand instead of the sending platform.
DNS Verification (TXT)
Proving domain ownership by publishing a provider-issued token as a DNS TXT record. BYOB custom-domain and sender setup both use this challenge before activating routing or sending.
Complaint Feedback Loop
A mailbox-provider channel reporting when recipients mark mail as spam, so senders can suppress complainers immediately. Ignoring complaints burns sender reputation far faster than any single campaign gains.