The sending server signs selected headers and the body with a private key; the matching public key is published in DNS as a TXT record at `selector._domainkey.yourdomain`. Receivers fetch that key, verify the signature, and confirm both that the content was unmodified and that the signing domain (the `d=` value) is legitimate.
Because DKIM is tied to message content rather than the connecting IP, it survives forwarding far better than SPF — but any modification in transit, such as a mailing list appending a footer, can break the signature and cause a fail. Key strength matters too: use 2048-bit keys, and remember that the signing domain is what DMARC aligns against.
Practically: enable DKIM signing at your email provider, publish the selector record it gives you, prefer 2048-bit keys, and rotate them periodically. Alignment between the DKIM `d=` domain and the visible From domain is what allows DMARC to pass on DKIM alone.