DKIM adds a cryptographic signature to outgoing email. The sending server signs each message with a private key, and receivers check it against a public key published in the domain's DNS.