Deliverability glossary · Updated 2026-08-10
DKIM
Also called: DomainKeys Identified Mail
DKIM cryptographically signs outgoing email with a private key. Receivers fetch the matching public key from DNS and verify the signature, proving the message was authorised and not altered in transit.
Where SPF authorises servers, DKIM authorises messages. The sending system signs selected headers and the body with a private key; the public half is published in DNS at `selector._domainkey.yourdomain.com`. A receiver recomputes the hash and compares.
The signature survives forwarding, which is DKIM’s main advantage over SPF. When a mailing list or a corporate forwarder relays your message, the envelope sender changes and SPF breaks — but the DKIM signature still validates, so DMARC can still pass on the DKIM leg.
Amazon SES uses three CNAME records rather than a single TXT, pointing at Amazon-hosted keys so rotation can happen without you republishing anything. All three must be present; two out of three leaves the identity unverified, and this is the most common reason a domain sits in pending for days.
DKIM verification is what actually unblocks sending on most platforms, including SES. Until the signature validates, the identity is not trusted to send at all.
How Raechly handles it
The three DKIM CNAMEs come back from `create_domain`, and `check_domain` polls SES directly for verification status. A domain only becomes send-eligible once DKIM verification succeeds.
Related terms
SPF record
An SPF record is a DNS TXT record listing which servers are allowed to send mail for your domain.
DMARC
DMARC is a DNS policy that tells receivers what to do when a message fails SPF and DKIM alignment: nothing, quarantine it, or reject it.
Sending reputation
Sending reputation is the trust score mailbox providers assign to your domain and IP based on complaint rate, bounce rate, engagement and authentication history.
Back to the full deliverability glossary, or read how these pieces fit together in how Raechly protects deliverability.