DKIM Explained: How Email Signing Protects Deliverability

What a DKIM signature proves, where the key lives, and why a passing signature still does not make a template safe.

DKIM is a signature on a message, checked against a public key in your DNS. If the signature validates, the receiver can see that the signer authorised that body and those headers, and that they were not altered in transit. It does not say the content is welcome. A signed template sent to the wrong list still looks like a template.

A usable definition: DKIM is a cryptographic signature that ties a message to a domain key published in DNS.

What you set up

The sending service gives you a selector, a hostname such as selector._domainkey.yourdomain, and a TXT value that holds the public key. You publish that TXT. The service signs outgoing mail with the private key. You do not put the private key in a document or a ticket.

When you add a second sender, it often needs its own selector. Leaving the old selector in place is normal. Deleting it while old mail is still in flight, or while a forwarder still checks it, creates failures you will blame on the copy.

What DKIM does not fix

A aligned, signed message can still miss the inbox because people do not reply, because the list bounces, or because every email shares one shape. Alignment is a DMARC question: the domain in the signature should relate to the domain the person sees. Sendblox can draft a different email per contact from the CRM. It cannot sign mail for a domain whose key you never published.

Before you publish a change for DKIM, write down the date, the record you edited, and the one message you used as a test. A week later, check whether that test still matches production. Provider rules, DNS includes, and CRM fields all move. A page that was true in general can be wrong on your domain if nobody looked again. Keep the send small until that check is dull. One contact, one objective, a person reading the draft. If the test fails, stop the campaign. Do not widen it to see whether a larger list forgives a broken setup.