DKIM checker

What DKIM is

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message your server sends. The sending system holds a private key and signs selected headers and the body. You publish the matching public key in DNS. The receiver reads the DKIM-Signature header, fetches the public key and verifies that the message was signed by the claimed domain and was not altered in transit.

Unlike SPF, a DKIM signature travels with the message, so it normally survives forwarding. Google and Yahoo require it from bulk senders (see the Gmail and Yahoo sender requirements).

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=example.com; s=google; h=from:to:subject:date;
 bh=...; b=...

Selectors: why DKIM is harder to look up

A domain can have many DKIM keys, one for each sending service. Each key lives at a name built from its selector: <selector>._domainkey.<domain>. DNS has no way to list every selector, so a checker has to know or guess the selector. SendClean tries the selectors used by the providers it detects from your MX and SPF records, plus common generic ones. If yours is unusual, open the advanced option on the scan form and enter it.

You can find your selector in the s= tag of the DKIM-Signature header on any message you sent: choose "Show original" in Gmail and look for it.

• Google Workspace usually uses google.
• Microsoft 365 uses selector1 and selector2, published as CNAME records pointing at Microsoft.
• SendGrid domain authentication commonly uses s1 and s2 CNAMEs.
• Mailchimp commonly uses k1.
• Amazon SES Easy DKIM publishes three CNAME records with long random-looking selectors.

Treat that list as a starting point. Providers change their setup, so always copy the exact records from your provider's dashboard.

How to read the result

A published key is a TXT record (or a CNAME that leads to one) that looks like this:

google._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

• v=DKIM1 identifies the record version.
• k=rsa is the key type. Ed25519 (k=ed25519) exists but not every receiver supports it.
• p= is the base64 public key. An empty p= means the key has been revoked.
• t=y marks the domain as testing DKIM. Remove it when you go live.

Use 2048-bit RSA keys where your DNS host allows it. 1024-bit keys are still accepted but are considered weak, and 2048-bit is what Google recommends. Because 2048-bit keys exceed 255 characters, they must be stored as several quoted strings in one TXT record, which most DNS dashboards do for you.

Finding a valid key tells you the DNS side is right. It cannot prove your mail is actually being signed with it. Send a message to a Gmail address and check that the "Show original" page says DKIM: PASS.

Common DKIM mistakes

• Publishing the key but never switching signing on in the provider. Many services need you to click verify or enable after the DNS records appear.
• The domain typed twice. Some DNS hosts append your domain automatically, turning google._domainkey.example.com into google._domainkey.example.com.example.com. Enter only google._domainkey in those hosts.
• Breaking the key while copying it: stray spaces, line breaks, smart quotes, or a truncated value.
• Leaving t=y in place after testing.
• Using an old, short key and never rotating it. Rotate by publishing a new selector, switching signing to it, and removing the old one later.
• Signing with the provider's domain instead of yours. If the signature says d=sendgrid.net, DKIM can pass while DMARC still fails, because the signing domain does not match your From domain. Set up custom-domain authentication in the provider.

How to set up DKIM

1. In your sending service's dashboard, find the domain authentication or DKIM setting and generate the records.
2. Add them to your DNS exactly as shown (TXT or CNAME, as the provider specifies).
3. Wait for DNS to update, then click the provider's verify button.
4. Enable signing, send a test message, and look for dkim=pass in the headers.
5. Scan the domain here to confirm the key is visible to the public.

Do this for every service that sends as your domain. Each has its own selector and key, and they can coexist.