DKIM (DomainKeys Identified Mail)
A digital signature on outgoing mail, verified against a public key in DNS, that proves the message was not altered and really came from the domain that signed it.
DKIM signs each outgoing message with a private key held by the sending server. The matching public key is published in DNS at <selector>._domainkey.<domain>. The receiving server fetches it, checks the signature, and knows the message was sent through a server that holds the key and has not been modified since.
The selector is a name that lets a domain publish several keys at once, for example one per mail provider or one per year. The signed message carries the selector in its DKIM-Signature header (the s= tag), so the receiver knows which key to fetch.
Unlike SPF, DKIM survives forwarding: the signature travels with the message. It is the stronger of the two for DMARC alignment, and the one you want working first. Keys should be 2048-bit RSA or Ed25519, and rotating them once a year is good practice.