Deliverability
DKIM
DKIM adds a cryptographic signature to every message you send, which the receiving server checks against a public key in your DNS. It proves the message came from your domain and was not altered on the way.
Where SPF authorises a server, DKIM authenticates the message. That difference matters when mail is forwarded: forwarding breaks SPF because the sending server changes, but the DKIM signature travels with the message and still validates.
Setting it up means letting your sending platform generate a key pair and publishing the public half as a DNS record. Every mainstream provider walks you through it and the job takes minutes, which makes an unsigned domain a purely self-inflicted problem.
Goes deeper: Why Your Cold Emails Land in Spam