DKIM
A digital signature on each message that proves it was not altered and came from a domain that published a key.
Say it out loud
“A tamper-proof seal on every message. The receiver checks it against a key we publish publicly.”
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail, covering the body and a chosen set of headers. Receivers verify it against a public key in your DNS. “DKIM passing” means the signature is mathematically valid — which is not the same, and this trips up everybody, as the signature belonging to your domain.
"kl" is the selector. Klaviyo uses kl and kl2, Mailchimp k1, Google google, Microsoft selector1. You cannot list selectors from DNS — you have to know them.
An empty p= means the key is revoked, not present. Naive checkers report it as “DKIM found”.
d= is the domain being vouched for. If this says your platform's domain rather than yours, DKIM passes and DMARC fails.
Part yours
The platform does part; the rest is genuinely yours.
What goes wrong
Removing or rotating a key while mail sent with it is still in flight, or in transit through a forwarder. Signatures verified after the key disappears simply fail, and the failure looks exactly like an attack.
What people get told
The claim. “DKIM passing means we are authenticated.”
Actually. It means the signature is valid. It can be perfectly valid and belong to your platform's domain rather than yours, in which case DMARC fails while every dashboard shows green. This is the most common silent deliverability failure in existence.
Check it yourself
Probe the selectors your platform actually uses
Run it now →The dated rules behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 3, it leaves your building. Your platform hands the message to a mail server, which stamps it with proof of who sent it.