What it is
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outbound mail that receivers verify against a public key published in DNS. Without DKIM, DMARC alignment can only rely on SPF, which fails on legitimate forwarded mail and gets brittle under any mail-flow change (new marketing platform, new e-sign vendor, forwarded newsletters).
Why it matters
Attackers rarely attack DKIM directly, they attack its absence. A domain with SPF-only alignment produces intermittent DMARC failures on legitimate mail, which pressures the domain owner to set p=none and keep it there. That permissive posture is what the attacker actually wants.
The check behind the finding
Send yourself an email and view its headers. Look for dkim=pass and your own domain after d=.
Closing it
This can be closed. It is done one sending service at a time, so that no real mail is lost on the way. The assessment gives the exact steps for the domain.