DKIM adds a cryptographic signature proving a message was not altered and genuinely came from your domain.
HOW IT WORKS
Your server signs outgoing mail with a private key. A matching public key is published in your DNS. The receiving server checks one against the other.
SETTING IT UP
cPanel > Email Deliverability. Where DKIM is missing, click Repair.
Where your DNS is hosted elsewhere, copy the suggested record and add it at that provider. DKIM records are long; copy rather than retype, and watch for line breaks being introduced.
WHY IT MATTERS
DKIM survives forwarding better than SPF does. A forwarded message usually fails SPF because the forwarding server is not on your list, but the DKIM signature still validates.
It is also required for DMARC to be useful.
CHECKING IT WORKS
Send a message to an address you control at Gmail, open it, and view the original or the headers. You should see DKIM listed as pass.
IF IT FAILS
Usually the DNS record was truncated or altered when copied. Compare it character by character against what cPanel shows.
