Free DKIM check

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email, using a private key that only the sending party holds. The receiving mail server fetches the matching public key from your DNS and checks whether the signature adds up and whether the message was altered on the way.

Unlike SPF and DMARC, a DKIM record does not sit at a fixed, predictable address. It sits on <selector>._domainkey.yourdomain.com, where the selector is a name the sending party chooses itself, for instance google, selector1 or any name of its own. That is why a domain can hold several DKIM keys side by side, one per sending service (your own mail server, newsletter system, CRM), each with its own selector.

It also makes DKIM the hardest record to check without knowing the exact selector. It is not stored anywhere central, only in the configuration instructions of your mail provider (look for "DKIM" in their documentation or settings panel). Our check therefore tries a list of common selectors first; if it does not find yours, enter the exact selector above.

A DKIM record itself looks roughly like this: v=DKIM1; k=rsa; p=MIGfMA0GCSq.... The key part is p=, the public key itself: a long, random-looking string. If nothing is there (an empty p=), the key has been revoked and every signature using this selector is treated as invalid.

DKIM only really contributes to your email security in combination with DMARC: DMARC requires the DKIM signature to be "aligned" with the visible sender domain, not merely technically valid.