What is DKIM?
DomainKeys Identified Mail — a cryptographic signature your mail provider adds to each message, verified against a public key published in your DNS.
DKIM proves that a message was sent by a server holding your domain's private key and that its content wasn't altered in transit. Your provider (Google Workspace, Microsoft 365) generates the key pair; you publish the public half as a DNS record under a selector such as google._domainkey.yourdomain.com and then enable signing. Use 2048-bit keys where offered. DKIM survives forwarding, which SPF does not, and its d= domain is what DMARC alignment usually relies on.