DKIM

Think of it as a wax seal on a letter. If the seal arrives intact, you know nobody opened it and changed the contents. DKIM does the same job digitally — the receiving server checks the signature and confirms the email is exactly what you sent.

Setting it up is straightforward: your email provider generates the record, and you add it to your DNS. That second step is the one that gets missed. Google Workspace and Microsoft 365 walk you through the basics, but they don’t log into your registrar and add the records for you. Someone still has to do that — and often, nobody did.

DKIM works alongside SPF and DMARC. One on its own helps; you want all three.