DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to each email so the receiver can check that the message came from your domain and was not changed.
DKIM works with a pair of keys. Your mail server signs each outgoing message with a private key. The matching public key sits in your DNS, in a TXT or CNAME record at a name like 'selector._domainkey.yourdomain.com'. The receiver reads the signature, fetches the public key and checks that the signed parts of the message are unchanged.
The signature names a domain (the 'd=' value). For DMARC to pass on DKIM, that domain must match the domain in your From address. If your email provider signs with its own domain, DKIM can pass and still not count for your domain.
Common mistakes in cold email: DKIM is never turned on for a new Google Workspace or Microsoft 365 domain, the record is pasted with a broken line, or a short 1024-bit key is used when 2048 bits is available. Turn DKIM on for every sending domain, publish the record exactly as given, and test with a real message after you change anything.
In Terlido
If Terlido does not detect a DKIM key for a sending domain, it keeps sending but limits Outreach to 10 sends a day per mailbox until it detects one.
Free tools
Related terms
- SPF (Sender Policy Framework)
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
- DMARC alignment