DKIM

How it works

• Your mail service signs each outgoing message with a private key.
• You publish the matching public key in your domain's DNS.
• The receiving inbox checks the signature. A match means the message was not altered.
• Every service that sends on your behalf (newsletters, invoicing) needs its own DKIM setup.

What can go wrong (example scenario)

A five-person marketing agency sent invoices from their own domain through a newsletter tool with no DKIM set up. Gmail started dropping their messages into spam, and two clients paid late because they never saw the invoice.

How WILDCARD handles it

Domain Security covers the DNS side of email trust: publishing the DKIM keys for each service that sends for you, and updating them when a vendor rotates keys. Email Security checks the same signals on mail coming in.

• A non-profit sends its monthly newsletter through Mailchimp and needs a DKIM key published for that tool, separate from Microsoft 365.
• A retailer's point-of-sale system emails receipts from the shop's domain. Without DKIM, receipts land in spam.
• A contractor sends quotes from a quoting app. DKIM lets customers' inboxes trust those quotes came from him.

Example scenario: A three-person accounting practice noticed their Microsoft 365 email reached clients but their invoicing software's emails did not. The invoicing tool had never been added to DNS. One DKIM record later, the invoices showed up in inboxes instead of junk.

A question owners ask

Does DKIM stop someone from faking my email address?

On its own, no. It proves which messages are genuine, and DMARC uses that proof to tell inboxes what to do with the fakes. You need SPF, DKIM and DMARC together.