DKIM
A signature on outgoing mail that ties the message to a signing domain and shows the covered headers and body were not altered on the way.
See it
What it is
DKIM signs each outgoing message with a private key your sending service holds, and publishes the matching public key in DNS at 'selector._domainkey.signingdomain.com'. The receiver pulls that key and recomputes the signature. A pass proves two narrow things: somebody holding the private key for the domain in the d= tag signed this message, and the headers and body covered by that signature arrived unchanged. It says nothing about who wrote the mail, and the 'd=' domain is often your vendor rather than you, which is exactly what DMARC alignment is there to check.
Turn it on for every stream you send, transactional and marketing alike. The selector is what lets multiple vendors coexist: your ESP gets 'ses1._domainkey', your helpdesk gets another, and each has its own key. Most providers now hand you CNAME records instead of raw keys so they can rotate the key for you.
The gotcha is fragility on the way out. Edits to signed content break the signature: mailing lists appending footers, some security gateways, aggressive link rewriting. Not every rewrite is fatal, though. Only the headers named in the 'h=' tag and the body covered by the signature are protected, and the canonicalization mode ('relaxed' tolerates whitespace and header folding changes, 'simple' does not) decides how much fiddling survives. Plain forwarding usually keeps DKIM intact even though it kills SPF, which is why DKIM is the leg of authentication you want carrying your DMARC pass. Use 2048-bit keys, and rotate them on a schedule rather than never.
Ask AI for it
I will paste the DKIM records that Amazon SES and Postmark generated for example.com. For each record, validate the name, the type (raw TXT key or provider CNAME), the target, the signing domain the provider will put in 'd=', and the key length, then tell me whether that signing domain aligns with a From address at example.com under relaxed and under strict DMARC alignment. The selectors and targets are account-generated, so do not invent them: if something is missing from what I pasted, name the dashboard screen that produces it and mark it as a value I must copy. Then write the verification steps: publish, wait out the TTL, send a test message to a Gmail address, open 'Show original', and point at the exact line of the Authentication-Results header that proves DKIM passed and which domain the 'd=' tag must show. End with a key rotation cadence.