About this tool. DKIM puts a tamper-proof cryptographic signature on outgoing mail, published under a 'selector' in your DNS. Enter selector:yourdomain.com to check a specific selector, or just a domain and we'll probe two dozen common selectors used by the big providers.
Ten signals decide whether your mail arrives. You just checked one.
A published DKIM key is not the same as a signed message. The checkup reads the key, the SPF record and the DMARC policy together, which is the only way to see which one is letting the other two down.
- SPF, DKIM, DMARC, MX and blocklist status, graded A to F in one pass
- Every problem written out in plain English, with the record to publish
- Saved under Reports, so you can re-run it and see what changed
- One domain watched against the blocklists daily
Run the full checkup free
No card, and nothing to cancel.
How to read your DKIM record
- DKIM adds a cryptographic signature to your mail. We look up the public key at selector._domainkey.yourdomain and validate it.
- You need the selector to check DKIM. It is shown in the DKIM-Signature header of a message you have sent (the s= value).
- A valid, correctly sized key (1024-bit minimum, 2048 preferred) is what receivers use to confirm the message was not altered.
Common problems and how to fix them
DKIM not found
Confirm you are using the right selector, and that your provider's DKIM is enabled and published in DNS. Each provider uses its own selector name.
DKIM was working, now it fails
A key rotation or a truncated DNS record can break it. Republish the full public key exactly as your provider gives it.
Common questions.What is a DKIM selector?
A label that points to a specific public key in DNS, at selector._domainkey.yourdomain. It lets you rotate keys without downtime.
How do I find my DKIM selector?
Look at the DKIM-Signature header of an email you sent. The s= value is the selector.
Does DKIM stop spoofing?
DKIM proves a message was not altered and came from an authorized key. Combined with DMARC, it stops attackers from forging your domain.