The sending server hashes selected headers and the body and adds the result as a DKIM-Signature header. It contains the signing domain (d=) and a selector (s=). The receiver fetches the key from selector._domainkey.domain via a TXT lookup.
Unlike SPF, DKIM survives forwarding as long as the message is not modified. Selectors let several services (your own server, Microsoft 365, a newsletter tool) use separate keys and make key rotation possible without downtime.
Typical reasons for dkim=fail: mailing lists or gateways that change the subject or body, a truncated key in DNS, or a service signing with a different domain than the one in the From header.
Example
dig +short TXT mail2024._domainkey.example.com