DKIM
DKIM cryptographically signs your outgoing email so the recipient's mail server can confirm the message is genuine and unaltered in transit.
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. Your sending platform signs each email with a private key and places the signature in a DKIM-Signature header, while the matching public key is published in a DNS record at selector._domainkey.yourdomain. The receiving mail server retrieves that public key and verifies the signature, proving the message was not altered in transit and that your domain authorized the send.
Why does DKIM matter?
For an online store, DKIM is what gets order confirmations, newsletters, and invoices into the inbox. A valid DKIM signature sharply reduces the chance of spam filtering, and since 2024 Gmail and Yahoo require DKIM outright from high-volume senders. DKIM works alongside SPF and DMARC: DMARC passes when either SPF or DKIM passes with domain alignment, so DKIM is a core building block of trustworthy delivery.
Common use cases
- Setting up your own sending domain for Shopify emails so the store sends from
yourstore.cominstead of a shared domain. - Troubleshooting deliverability when messages land in spam or get rejected by strict recipients.
- Meeting Gmail/Yahoo requirements for bulk senders to authenticate with DKIM, SPF, and DMARC.
- Connecting email tools like Klaviyo or Mailchimp that require domain verification before they can sign on your behalf.
Shopify perspective
In Shopify, you authenticate your sending domain by adding four CNAME records supplied by Shopify to your DNS. They delegate DKIM signing (and SPF) to Shopify’s mail servers, so both notifications and Shopify Email are sent authenticated. After setup, confirm the records are live and test a real email with a tool like mail-tester or Google Postmaster rather than assuming everything works.