In more detail
The sending server signs selected headers and the body; the DKIM-Signature header names the domain (d=) and selector (s=) to look up. A valid signature shows the message came through a server authorised by that domain and was not changed in transit. It is one leg of DMARC. The receiver fetches the public key from a DNS TXT record at selector._domainkey.domain, recomputes the body hash (bh=) and checks the signature (b=). The c= tag chooses how strictly whitespace and header case are normalised before hashing, and relaxed/relaxed is the usual choice.
Why it matters
Without DKIM, many receivers treat bulk mail as suspicious, and DMARC can only pass through SPF, which breaks when mail is forwarded. Selectors let you rotate keys or give each email provider its own key. Use RSA keys of at least 2048 bits; 1024-bit keys are the bare minimum allowed and considered weak.
Example
A shortened signature header and the DNS record it points to:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com;
s=s1; h=from:to:subject:date; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
b=Gk3x...
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
The bh= value shown is the Base64 SHA-256 of an empty body under relaxed canonicalization. Create the record with the DKIM Record Generator and check a received message with the Email Header & Security Analyzer.