DKIM signs selected message headers and the body with a private key held by the sending infrastructure. The public key is published as a DNS TXT record under a selector (e.g. pp._domainkey.example.com), and receivers verify the signature against it.
Unlike SPF, DKIM survives most forwarding because the signature travels with the message rather than depending on the connecting IP. A DKIM pass also does not require the signing domain to match the visible From address unless DMARC alignment is being evaluated.
PulsePigeon generates a domain-specific DKIM selector during sending-domain verification; rotate keys periodically and remove old selectors from DNS once traffic has fully cut over.