DKIM
DomainKeys Identified Mail — a method where outgoing email is cryptographically signed with the domain's private key, so the recipient can verify that the mail really comes from the domain and hasn't been altered in transit. The second pillar (with SPF) in email authentication.
Mechanic: the sending server signs the email (selected headers + body) with a private key and puts the signature in a DKIM-Signature header. The public key is published in the domain's DNS (under a "selector"). The recipient fetches the public key, verifies the signature → if it matches, the email is provably from the domain and unchanged since signing. Advantage over SPF: DKIM survives forwarding (the signature travels with the email, independent of which server relays it) and verifies the content's integrity. Limitation: like SPF, DKIM verifies a domain identity but doesn't in itself link it to the visible From address — that's done by DMARC, which requires SPF or DKIM to "align" with what the user sees. SPF + DKIM + DMARC together make up modern email authentication. Related to SPF record and business email compromise.