DKIM

Also called: DomainKeys Identified Mail.

DKIM is defined in RFC 6376. The sending server signs selected headers and the body with a private key and adds a DKIM-Signature header. The receiver fetches the matching public key from DNS, at selector._domainkey.yourdomain.com, and checks the signature.

A passing DKIM signature proves the message was signed by the domain in its d= tag and that the signed parts weren't changed in transit. Unlike SPF, it survives forwarding, which makes it the more reliable of the two for DMARC alignment.

Google requires bulk senders to Gmail to set up DKIM as well as SPF, Yahoo requires both for bulk senders, and Outlook.com requires high-volume senders to pass DKIM. Most mailbox providers and sending tools give you the DNS record to publish; the step people skip is making sure the signing domain matches the From domain.

For cold email, enable DKIM on every sending domain and mailbox before warm-up, and check a real message's headers for dkim=pass with your own domain rather than the provider's default.

Example

A received message shows dkim=pass header.d=getacmeagency.com. The signature matches the From domain, so it can satisfy DMARC alignment.