DKIM – email security, delivery and brand experience

5 minute read

SMTP, that’s the ‘Simple Mail Transfer Protocol’ that is used for email transmission, allows any computer to send email from any source address. It’s an open door for spammers, forgers and phishers. SPF and DKIM are two of the ways that you can identify yourself to your subscribers as a legitimate email marketer. They’ll reassure your audience that your email messages are what and from whom they say they are, and by doing so they’ll increase your chances of successful delivery and engagement.


SPF – Sender Policy Framework

SPF is a method which servers receiving email can use to verify that the person sending the message is indeed allowed to send emails from that domain name. It’s a small piece of text that is stored in the DNS record of your domain name which validates the originating email address of your message. When a system receives email from you, it checks this record against the details of the server that sent your message. SPF adds an extra layer of security to email since only the owner of a domain name can alter its DNS record. It makes it much more difficult to send email from forged addresses and means legitimate email can be more easily separated from junk.

DKIM – Domain Keys Identified Mail

DKIM is in some respects the next level. It’s like an encrypted digital fingerprint or signature which can be used to verify the credentials of email traffic. DKIM works by using a private domain key to encrypt your domain’s outgoing mail headers, and adding a public version of the key to the domain’s DNS records. Comparison of the decrypted original and the received headers can then be used to check that all is well – that your email comes from your domain and that it hasn’t been changed along the way.

As a customer you have 3 main DKIM options.

Star1Standard SUT Domain Keys – means that the emails you send through the platform are verified according to’s own DKIM settings and sender domain. It’s an important security provision. As a dedicated Email Service Provider we take great care of our sender relationships and reputation, so identifying with this will be of direct benefit in terms of delivery. However, depending on their email client (for example in Outlook and Gmail) your audience may see your emails as a delivery which is sent by (SUT) ‘on behalf of’ yourself.

Standard SUT Domain Keys is created as a default for every user.

Star2Basic Custom DKIM – uses a modification of your DNS records to more specifically identify your own brand as the originator of your email messages. It instructs our mailservers to sign your email delivery with your own ‘from’ address domain rather than by ‘on behalf of’ yourself. The benefit in terms of security is largely the same as the Standard DKIM. However, reinforcement of your own brand as the sender offers an improved inbox experience for your recipients which can result in elevated open and engagement rates. However since this introduces a degree of separation between our and your own sender reputations it may also have other implications for future delivery.

Basic Custom DKIM is now offered as a free upgrade service to all Sign-Up. to customers.

Star3Branded DKIM – allows a deeper level of DKIM customisation by creating your own custom domain. Although a Basic Custom DKIM replaces the ‘on behalf of’ sending references with those of your own domain, the association with can still be seen in branded URL items like forms, tracking links and your unsubscribe page. The custom domain of a Branded DKIM more thoroughly removes references to from all of these items. This further reinforces your own brand as the sole owner and sender of your messages. However, since the custom domain now completely separates you from the reputation of our shared sending channel domains the implications for delivery become increasingly dependent on your own best-practices.

Branded DKIM is offered as an optional customisation service by our Client Success Team.


Read more about Sender ID, SPF and DKIM in our Knowledge Base Guide.