Definition
The sending tool signs the message with a private key; the public key is published in a TXT record of the domain, at selector._domainkey.example.com. The recipient checks the signature with that key: the message really comes from the domain named in the signature (the d= tag), and its content did not change on the way.
RFC 8301 bans the rsa-sha1 algorithm and requires RSA keys of at least 1,024 bits, recommending 2,048 bits. RFC 8463 adds the Ed25519 algorithm, with a short key, to be used as a second signature alongside RSA for compatibility.
Value for a business owner
DKIM survives forwarding better than SPF: a forwarded message can fail SPF and keep a valid DKIM signature. Gmail requires it, with SPF, from senders of around 5,000 messages a day or more, and Yahoo asks for a key of at least 1,024 bits.
At Stratedge Consulting
We enable DKIM in the tools that send on behalf of the domain, with your domain in the signature. Our free SPF, DKIM and DMARC test checks that keys are published and how long they are.
Common mistakes
Letting a tool sign with its own domain: the signature is valid, but it is not aligned and does not count for DMARC.
Keeping a 1,024-bit key published years ago, when the standard recommends 2,048 bits.