DKIM

With DKIM, the sending server signs selected parts of each message using a private key. The matching public key is published in the sender's DNS. Receiving servers retrieve the public key and check the signature. A valid signature shows that an authorized system for that domain sent the message and that the signed content was not changed.

DKIM survives most forwarding, unlike SPF, which makes it especially important for DMARC to pass reliably. Microsoft 365 supports DKIM signing for custom domains, but it must be enabled and the DNS records published; it is not automatically active for every custom domain. Third-party services that send on your behalf, such as marketing or invoicing platforms, usually need their own DKIM setup.

For a Canadian SMB, enabling DKIM is typically a short project with a lasting benefit. Combined with SPF and a DMARC policy at quarantine or reject, it makes direct spoofing of your domain much harder and improves the chance that legitimate email reaches clients.