DKIM
In one line
DKIM, DomainKeys Identified Mail, adds a digital signature to each email you send. You publish a matching public key in DNS, so receiving servers can check that the message really came from your domain and was not altered on the way.
A seal on every message
Think of DKIM as a wax seal. Your mail service signs each outgoing message with a private key that only it holds. You publish the matching public key in your DNS. A receiving server reads the signature, looks up your public key and checks that they fit. If they do, the message is genuine and has not been changed since it left.
What you add to DNS
The public key lives in a DNS record under a special name that includes a selector. A selector is a label that lets one domain have several keys at once, for example one per mail service. The name looks like selector1._domainkey.example.com, and the value is a long string of letters and numbers. Some services ask for a CNAME record instead, which points to a key they manage and rotate for you.
Always copy the record exactly as your mail service shows it. A missing character will make the check fail, and the long value is easy to cut by accident. Some DNS editors split very long values, which is fine if the service says it is.
One key per sender
Each service that sends mail as your domain needs its own DKIM setup, so the number of records grows with the number of services. That is normal. Remove a record when you stop using the service that needs it, but only when you are sure it is no longer in use.
Why it helps
A signed message is more likely to reach an inbox. It also lets receivers see which messages are truly yours. Together with SPF, which lists who may send, and DMARC, which sets the policy, DKIM makes it much harder for someone to send convincing fake mail from your name.
DKIM and your website
Your website and your email are separate. Pointing a domain at a website does not touch DKIM, as long as you leave the mail records in place. The guide to pointing a domain at a website shows how to change only what is needed.
Questions people ask
What is a DKIM selector?
A selector is a label in the DNS name of a DKIM key. It lets a domain publish several keys at once, for example one per mail service, so each can be added, changed or removed without affecting the others.
Do I need to set up DKIM myself?
Your mail service usually gives you the exact record to add at your DNS host. The step is yours, because only you can edit your DNS. Once the record is in place, the service starts signing messages.