What is DKIM?
DKIM adds a digital signature to outgoing email so receiving servers can check that the message was not altered and comes from an authorised service.
Reviewed:
When a normal email looks suspicious
Sometimes you send a perfectly normal email and the recipient sees a warning, or the message lands in spam.
That does not always mean the message content is bad. Often the receiving server simply does not have enough signals to trust it.
DKIM is one of those signals.
Quick answer
DKIM is a digital signature added to outgoing email.
It is not a visible signature at the end of the message. It is a technical check stored in the email headers.
When the recipient receives the message, their mail server can look up the domain's DNS and verify the signature.
If it matches, the receiver has more confidence that the message is legitimate and has not been modified in transit.
What happens without DKIM?
Email may still work, but some receivers will have fewer reasons to trust it.
You may see:
- messages going to spam;
- warnings in Gmail, Microsoft or similar services;
- weaker proof that the message belongs to your domain;
- worse results when DMARC is also used.
DKIM is not strictly required to send email, but it is increasingly recommended.
DKIM does not replace SPF
SPF and DKIM do different jobs.
SPF checks whether the sending server is authorised.
DKIM checks a signature on the message.
A domain can have SPF without DKIM, DKIM without SPF, or both. In practice, having both is better.
How PRIMARI.NET handles it
When your email is hosted at PRIMARI.NET, we can generate the domain's DKIM key and configure the mail server to sign outgoing messages.
Then a TXT record must be published in DNS:
primari._domainkeyThis record contains the public key. The private key is never published.
If your DNS is also managed by PRIMARI.NET, the panel can prepare the correct record so you do not have to copy it manually.
When to contact PRIMARI.NET
Contact us if your mail goes to spam, if you are unsure whether DKIM is active, or if your email is at PRIMARI.NET but DNS is hosted elsewhere.
We can review DKIM signing, DNS and how it works together with SPF and DMARC.