The sending service holds a private key and uses it to sign parts of every message, including key headers and the body. The matching public key is published in DNS under a name called a selector. The receiving server reads the signature, fetches the public key, and checks that the message was signed by that domain and that the signed parts were not altered on the way.
DKIM ties a message to a domain in a way that normally survives forwarding, which SPF does not. Mailbox providers use it to build a reputation for the domain, and DMARC needs either DKIM or SPF to pass and match the visible From domain. Every service that sends mail for the business, such as a CRM or invoicing tool, should sign with the company's own domain.
The usual failure is a service that signs with its own domain instead of yours, which passes DKIM but does not satisfy DMARC. Each sending tool needs its own selector and DNS record, and many platforms leave DKIM switched off until an administrator enables it. Replace keys periodically. DKIM does not encrypt email; it only proves origin and integrity. We enable DKIM for each sending service during email setup.