Pick your email service provider and we'll generate the exact DKIM records you need to publish in DNS. Most modern providers use CNAMEs that point to ESP-managed key infrastructure (so they can rotate keys without you re-publishing); a few still require you to publish a raw TXT public key.
DKIM (DomainKeys Identified Mail) is one of the three pillars of modern email authentication, alongside SPF and DMARC. Receiving servers verify the DKIM signature against your published public key to confirm the message wasn't altered in transit and was authorised by your domain. Without DKIM, your DMARC policy can only rely on SPF, which breaks every time a message is forwarded.
For brand protection: a properly DKIM-signed email is much harder to spoof. Combined with DMARC at p=reject, attackers can't impersonate your domain even when they spoof the From header.