Outbound Glossary
DKIM
A signature that proves the message was not altered in transit. It survives forwarding, which is exactly why it matters more than SPF.
DKIM stands for DomainKeys Identified Mail. Your sending server signs each message with a private key, and the matching public key sits in your DNS so any receiver can check the signature. If the signed parts of the message changed on the way, the check fails.
The reason DKIM carries more weight than SPF in practice is forwarding. When a message is forwarded, the sending server changes and SPF breaks, but the DKIM signature travels with the message and still verifies. Rotate keys when you change providers, and use a key length of at least 1024 bits, because shorter keys are treated as weak.