What Is DKIM?
DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to an outgoing message using a private key, with the matching public key published in your DNS. The receiving server verifies the signature to confirm the message really came from your domain and was not modified along the way.
SPF and DKIM answer different questions. SPF asks whether this server is allowed to send for this domain. DKIM asks whether this specific message was signed by the domain and arrived intact. A message can pass one and fail the other.
DKIM survives forwarding, which is its practical advantage. When a mailing list or a forwarding rule relays your message, the connecting server changes and SPF breaks, but the signature still verifies as long as the message body was not rewritten.
Both are inputs to DMARC, which is the layer that finally ties authentication to the From address people actually see.