DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email, and publishes the matching public key in DNS, so a receiving server can verify that the message came from the domain it claims and was not altered in transit.
How it works
The sending server signs selected headers and the body of each message with a private key and adds the result as a DKIM-Signature header. That header names a selector and a domain. The receiver fetches the public key from DNS at selector._domainkey.domain and checks the signature. The standard is RFC 6376.
Because the signature covers the content, a message altered in transit fails. Because the key lives in the sender's DNS, only someone who controls that domain's DNS can publish a key that verifies.
What DKIM does not do
DKIM proves a message was signed by a domain — not that the domain matches the From address the reader sees. A scammer can sign mail with their own domain perfectly validly. Tying the signing domain to the visible From address is DMARC's job.
It is also not encryption. The message is readable by anyone who handles it; DKIM only makes tampering detectable.
How to check a message
Open the full headers of an email you received and find Authentication-Results. You are looking for dkim=pass and the domain it passed for.
DKIM at Mailotte
Mail sent from Mailotte is DKIM-signed. When you connect your own domain, Mailotte generates a signing key for it and gives you a TXT record to publish at selector._domainkey.yourdomain, so mail from your domain is signed as your domain rather than as mailotte.com.
Questions
Does DKIM encrypt my email?
No. It signs it, which makes tampering detectable. Anyone who handles the message can still read it.
What is a DKIM selector?
A label that says which key to look up, so one domain can have several keys at once — for example one per mail provider, or an old and a new key during rotation. The public key lives at selector._domainkey.yourdomain.
Why does DKIM pass but my mail still goes to spam?
Because DKIM only proves who signed the message. Receivers also weigh DMARC alignment, the sending server's reputation and the content.