Domain check / DKIM
<DKIM>DomainKeys Identified Mail
DKIM puts a digital signature on every email. That lets recipients check whether the message really comes from your domain and has not been altered along the way. Does the signature check out? Then your email arrives with more trust. Does it not? Then fraud is stopped.
<how it should be>
DKIM in order
- Every service that sends on your behalf signs with its own DKIM key.
- The public key is in your DNS under a selector, for example selector1._domainkey.
- Keys are long enough (2048 bit) and are replaced from time to time.