Reach CrewStart free

Glossary Deliverability

What is DKIM (DomainKeys Identified Mail)?

Also called DomainKeys Identified Mail

DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to each message, which receivers check against a public key published in the sender's DNS to confirm the email came from that domain and was not altered.

DKIM is defined in RFC 6376. The sending server signs selected headers and the body with a private key; the public key lives in a DNS TXT record under a selector, such as google._domainkey.yourdomain.com.

In Google Workspace, an admin generates the key and turns on signing in the Admin console under Gmail authentication. Until then, Google signs with a default domain that does not match yours, which does not help DMARC.

Why it matters

  • Google requires SPF or DKIM for every sender to Gmail, and both for bulk senders.
  • DKIM survives forwarding better than SPF, so it is the more reliable signal.
  • A DKIM signature that matches your From domain is what lets DMARC pass.

How Reach Crew handles it

Reach Crew sends each email through your own Gmail or Workspace account, so Google signs it the same way it signs everything else you send. If your Workspace admin has turned on DKIM for your domain, your Reach Crew emails carry that signature too. Reach Crew never edits your DNS.

Updated November 10, 2026.