DKIM adds a digital signature to every email you send. Your mail provider signs each message with a private key, and publishes the matching public key in your DNS. Receivers use the public key to check that the email really came from your domain and wasn't changed on the way.
Selectors
A domain can have several DKIM keys, each published under a name called a selector, such as google._domainkey.yourdomain.com. Each service that sends for you can have its own.
Why it matters for cold email
DKIM is one of the two ways an email can pass DMARC, and the more reliable one, because it survives forwarding. Gmail and Yahoo require it from bulk senders, and in practice cold email without it rarely reaches the inbox.
Turning it on
Publishing the key is only half of it: signing also has to be switched on at your mail provider. In Google Workspace that is a Start authentication button after the key is published. Use 2048-bit keys where you can.
What the record looks like
A DKIM record is a TXT record at selector._domainkey.yourdomain.com with a value such as v=DKIM1; k=rsa; p=MIIBIjANBg..., where the long p= value is the public key. Google requires keys of at least 1024 bits and recommends 2048. An empty p= means the key has been withdrawn.
How to check yours
Enter your domain and selector in the DKIM checker. If you don't know the selector, open an email you sent, show the original message, and read s= in its DKIM-Signature header.