DKIM DomainKeys Identified Mail

A signature under every email. Your mail server signs the message as it goes out, and the recipient checks the signature against a public key sitting as a TXT record in your DNS. If it matches, nobody changed anything along the way and the sender is proven.

The key sits under a selector, which is a sub-address like selector1._domainkey.example.com. The mail provider picks the selector. So DKIM can only be checked when the selector is known. If a tool finds none, that does not necessarily mean DKIM is missing.

Unlike SPF, DKIM survives forwarding: when a mailing list passes a message on, the signature stays valid.