What it does that SPF does not
SPF checks the sending server's address. Forward a message and that address changes, so SPF breaks. DKIM signs the message itself with a key published in your DNS, and the signature survives forwarding intact.
DMARC accepts either, so having both is what makes a strict policy safe to run.
Publish it
- Enable DKIM signing in your mail provider. It is usually a single switch in the admin console.
- The provider gives you one or two DNS records to publish, at names like
selector1._domainkey.yourdomain.com. - Publish them exactly as given. The values are long and truncating one is the most common mistake.
- Return to the provider and confirm signing is active. Some require you to verify after the DNS is in place.
- Repeat for every system that sends mail as you, not just your main provider.
Why an existing DKIM stops working
Providers rotate keys. If the published record is not updated to match, signatures stop verifying. Nothing on your side changes and no error appears. Where a provider offers to manage the record for you via CNAME, take it, because that removes this failure entirely.
A note on what we checked
DKIM records live at a selector name that varies by provider, and there is no way to list them. We check the selectors the major providers use. If you sign with an unusual selector we may report none found when one exists, which is a limitation worth knowing rather than a fault in your setup.