DKIM signs each outgoing message with a private key; receivers fetch the public key from your DNS (selector._domainkey.domain) and verify the signature. A valid signature proves origin and integrity.
Gmail, Outlook and friends effectively require DKIM for inbox placement. On panel servers it is usually enabled per domain — the trap is mail sent through paths that skip the signer (some PHP configurations), which then arrives unsigned and unloved.
Frequently asked questions
How do I check if my mail is DKIM-signed?
Send a message to a Gmail address and use “Show original” — it displays SPF, DKIM and DMARC results. Mail-tester.com gives the same plus a score.
What is a DKIM selector?
A name (like default) that picks which DNS key record to verify against — letting a domain hold several keys for different signers.