What DKIM checks in a cold email
The sending server creates the signature. The message headers include a DKIM-Signature field, while the domain’s DNS holds a TXT record with the public key. The receiving server finds that key through a selector, such as selector1._domainkey.company.ru, and checks whether it matches. If the message body or signed headers were changed after sending, the check fails.
This matters when outreach is sent through campaign infrastructure rather than manually from a corporate inbox. A receiving service sees more than the display name in the From field: it can verify the sending domain technically. DKIM works alongside <a href="/en/glossary/spf/">SPF</a> and DMARC; none of these controls replaces the others.
| Situation | What the recipient’s server sees | What it means |
|---|---|---|
| Signature passes | The domain has validated the message | One trust signal is present |
| No DKIM record | The domain’s authenticity is unconfirmed | The email is not automatically spam, but has less technical trust |
| Signature fails | The key, content or configuration does not match | The sending service and DNS need checking |
How a signing error affects an outreach campaign
DKIM does not create interest in an offer or repair an irrelevant prospect list. Its job is narrower: to prevent a technical error from removing an email’s chance of being considered. An email may be accepted by a server yet receive no reply because of its subject line, recipient or message—not because delivery itself failed.
For example, an industrial equipment supplier sends a note titled “Question about your machining capacity.” It asks two specific questions about machine utilisation and offers to prepare a calculation. A decision-maker may reply and ask which models the supplier works with. But if the signature points to an old domain or its DNS record disappeared during a migration, the same message may never reach a person to be assessed on its merits.
DKIM confirms the source of an email, not the quality of its offer. A valid signature cannot compensate for sending at random addresses or writing without a clear reason to contact the company.
Before launch, check the full chain: domain, mailbox, sending service and DNS. If you need a review of that infrastructure together with sending routes and domain reputation, see our <a href="/en/services/outreach-audit/">cold outreach and deliverability audit</a>.
Three mistakes that break DKIM validation
- The TXT record was added to the wrong domain. The key may sit on the main corporate domain while emails are sent from a separate subdomain or campaign domain.
- A sending service was connected, but domain verification was not completed in its settings. The DNS record may exist, while the service signs with a technical domain or does not sign the messages as intended.
- A DNS provider was changed and not every record was migrated. The website and email may still work, but the DKIM selector and public key remain with the previous provider.
A short check before the first send
- Open the source of a test email and find DKIM-Signature.
- Confirm that the verification result is pass, not neutral or fail.
- Compare the domain in the signature with the sending domain and DMARC policy.
- Repeat the test after changing the email provider, DNS or domain.
Do not confuse DKIM with <a href="/en/services/domain-warmup/">domain warm-up</a>. A signature is an identity configuration; warm-up is separate work on mailbox history and behaviour. Both matter, but gradually increasing volume will not repair a failed signature.
When DKIM is not the solution
DKIM is not a standalone answer to “we have no leads.” It will not make a recipient open an email, identify the decision-maker or explain why your offer matters to that company. If the message is accepted, the signature passes and replies do not come, examine the account list, first message and handling of inbound replies.
It is also not suitable for a domain whose DNS you cannot manage. An agency should not request access to a client’s keys without an agreed process; a separately prepared domain with clear ownership of DNS records is usually the cleaner option. For a complete setup, see <a href="/en/services/email-outreach/">B2B email outreach for Russia and CIS</a>.