DKIM
A cryptographic signature added to outgoing mail so the receiver can verify the message really came from the domain and was not altered.
DomainKeys Identified Mail signs selected headers and the body with a private key. The matching public key is published in DNS. A receiving server fetches the key, checks the signature, and learns that the message genuinely originated from that domain and arrived unmodified.
Unlike SPF, DKIM survives forwarding, because the signature travels with the message rather than depending on the connecting server's address.
A domain publishing DKIM keys is one that has been set up by someone who knows what they are doing. It is one of the signals that separates an established sending domain from a freshly registered one.