DKIM signing: Mail server hashes specific headers + body → encrypts hash with domain's private key → adds signature to email header. Receiver verifies using public key from DNS TXT record.
DKIM's private key must be protected — compromise = spoof all email from that domain. Rotate DKIM keys regularly. DKIM survives email forwarding better than SPF (SPF fails when a forwarder changes the sending IP).