It underpins DMARC
DMARC relies on SPF or DKIM passing with alignment. Broken DKIM weakens your whole anti-spoofing posture.
Free Email Tool
DKIM Checker
DKIM adds a tamper-proof signature to your outgoing mail, so receivers can verify it genuinely came from you and was not altered on the way. This guide explains the selector, the public key and the signing status to look for — and a specialist will check yours for you, free.
Information:
Automated checker coming soon
What this tool checks
What healthy DKIM signing looks like.
A DKIM check confirms your domain publishes a valid key and that your mail is actually being signed with it. These are the parts that matter.
-
A published DKIM record
Your domain should publish a DKIM public key at the right selector location in DNS.
-
The correct selector
Each sending service uses a named selector (like "google" or "selector1"). The published key must match what your mail server signs with.
-
A valid, strong public key
The key should be well-formed and a sensible length (1024-bit or, better, 2048-bit) so signatures can be verified.
-
Mail is actually being signed
Publishing a key is not enough — your outgoing messages must carry a DKIM-Signature header that validates against it.
-
Signatures pass verification
A correctly signed message verifies cleanly at the receiver; a broken or mismatched key fails and undermines authentication.
-
Every sender is covered
If several services send for you, each needs its own working DKIM selector and key — not just your main mailbox.
Why it matters
DKIM proves your mail is genuine.
DKIM works with SPF and DMARC to prove a message really came from you and was not tampered with. When it is missing or broken, trust drops.
It builds inbox trust
A valid signature is a strong signal to receivers that your mail is legitimate, helping it reach the inbox.
It detects tampering
DKIM proves the message body and key headers were not altered in transit, so recipients can trust what they read.
Common problems
The DKIM mistakes we see most.
Most DKIM issues are quiet — mail still flows, but it is not signed, so it earns less trust. A check surfaces them.
-
No DKIM at all
Mail is sent unsigned, so receivers cannot verify it and DMARC has less to rely on.
-
Wrong or missing selector
The signing service uses one selector but a different (or no) key is published, so verification fails.
-
A weak or truncated key
A 512-bit key, or one cut off by a DNS character limit, cannot be used to verify signatures reliably.
-
Only the main service is signed
Your mailbox provider signs, but your CRM or invoicing tool does not — so a chunk of your mail is unauthenticated.
Preview the checker
Check a domain's DKIM record
This is a preview of the automated DKIM checker we are building. It does not run a live lookup or store anything you type.
Coming soon
Automated checking is on its way. A human audit is available now.
We are building instant, automated checkers as part of our Email Operations Center roadmap. Until then, a specialist will run this check by hand as part of a free Email Audit — and explain what it means for your business in plain English, with no jargon and no obligation.
- A real specialist reviews your setup — not an automated guess.
- Plain-English findings and the next step that actually matters.
- Free, with no obligation — we work alongside your existing IT.
Questions
Answers, in plain English.
What is DKIM, in plain English?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email. The receiving server uses a public key you publish in DNS to verify the message genuinely came from your domain and was not altered in transit.
What is a DKIM selector?
A selector is a label that points to a specific DKIM public key in your DNS. It lets you run several keys at once — one per sending service, or for rotating keys — so each signature can be matched to the right published key.
Do I need DKIM if I already have SPF?
Yes. SPF and DKIM check different things, and DMARC relies on at least one of them passing with alignment. Running both gives you stronger authentication and better deliverability than either alone.
How long should my DKIM key be?
2048-bit is the modern recommendation; 1024-bit is still common and acceptable. Avoid 512-bit keys, which are too weak. Note that long keys sometimes need to be split across DNS records correctly, which is a frequent source of errors.
Does this tool verify my DKIM live?
Not yet — the automated checker is in development. This page explains DKIM and what a healthy setup looks like, and the form is a preview that does not run a live check. For results today, request a free manual audit.
My mail is sent but not signed — does that matter?
Yes. Unsigned mail cannot be verified by DKIM, earns less trust at the inbox, and gives DMARC less to work with. We make sure every service that sends for you is signing correctly.