DKIM
A scheme where the sending domain signs selected headers and the body of an email, with the public key published in DNS, defined in RFC 6376.
The sending server adds a DKIM-Signature header naming the signing domain (d=), a selector (s=), the signed headers (h=) and a body hash (bh=). The receiver fetches the public key from <selector>._domainkey.<domain> and verifies the signature, proving the signed parts were not altered and that the domain owner authorised the message.
Unlike SPF, DKIM survives forwarding as long as the message is not modified, which is why DMARC usually relies on it. Mailing lists that rewrite subjects or footers break it; ARC was created to carry authentication results across such hops.
Pitfalls: 1024-bit keys where 2048-bit is now expected, selectors that are never rotated, and confusing "DKIM pass" with "legitimate": attackers sign with their own lookalike domains. What matters is which d= signed and whether it aligns with the From: domain.