A security administrator wants to allow external organizations to cryptographically validate the company's domain name in email messages sent by employees. Which of the following should the security…

SPF specifies which IP addresses are authorized to send mail for a domain but does not cryptographically sign the message body or headers.

S/MIME provides end-to-end encryption and signing of message content between individual users, not domain-level cryptographic validation.

TLS encrypts the SMTP transport session between mail servers but does not provide domain-level cryptographic validation of the message itself.

DKIM (DomainKeys Identified Mail) works by having the sending mail server sign outgoing messages with a private key, while the corresponding public key is published in DNS as a TXT record. External organizations can retrieve that public key and validate the signature, cryptographically confirming the message originated from the legitimate domain owner.