DKIM adds a digital signature to emails, which helps recipients verify that the email was indeed sent from the claimed domain. This is done by creating a pair of cryptographic keys - one private and one public. The private key is used to sign the outgoing email, and the public key is published in the domain's DNS records for verification.