DKIM

DKIM (RFC 6376) lets a domain take responsibility for a message by signing it. The sending system hashes the body and selected headers and signs them with a private key, adding a DKIM-Signature header that names the signing domain (d=) and a selector (s=).

The receiver fetches the matching public key from DNS at selector._domainkey.domain (for example s1._domainkey.acme.com, usually a TXT record) and checks the signature. A pass proves the signed parts weren't altered in transit and that the signing domain authorised the message. Selectors let a domain run several keys at once, for example one per sending platform, and rotate them.

Unlike SPF, DKIM usually survives plain forwarding because the signature travels with the message, though it breaks if a mailing list or gateway rewrites the signed content. Google requires a key of at least 1024 bits for mail to personal Gmail accounts.

Google and Yahoo require bulk senders to use both SPF and DKIM, and DKIM is what usually makes DMARC pass. For outreach, signing with your own domain (not just your sending tool's default domain) builds reputation on a domain you control and keeps your From: domain aligned.

Skrap.ai doesn't set up DKIM for you; you configure it in your email platform and publish the key in DNS. Verifying your list before sending keeps bounces from undoing that work. Use the free email verifier or upload a CSV.