DKIM Checker Tool
Verify DKIM signatures and email authentication
Common selectors to try:
This page provides original, human-reviewed information about DKIM record validation, covering selector lookup, public key format, key length recommendations, and the most common causes of DKIM verification failure.
DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email message hasn't been tampered with during transit and that it was indeed sent by an authorized mail server for the domain.
How DKIM Works:
- Your mail server generates a cryptographic signature for each outgoing email
- The signature is created using a private key and added to the email headers
- You publish the corresponding public key in your DNS records
- Receiving mail servers use the public key to verify the signature
- If the signature is valid, the email is considered authentic and unmodified
DKIM Record Components:
- Selector: A unique identifier for the DKIM key (e.g., "default", "google")
- Domain: The domain that owns the DKIM key
- Public Key: The cryptographic public key used for signature verification
- Key Type: The algorithm used (typically RSA)
- Version: DKIM version (always "DKIM1")
Benefits of DKIM:
- Prevents email tampering and ensures message integrity
- Helps establish sender authenticity and reputation
- Improves email deliverability and reduces spam classification
- Required component for DMARC implementation
- Provides non-repudiation for sent emails
Best Practices:
- Use the selector provided by your email provider and keep records up to date.
- Rotate DKIM keys periodically for better security.
- Test signatures after configuration changes.
Step 1: Generate DKIM Keys
Generate a public/private key pair using your mail server or a DKIM key generator tool.
OpenSSL Command (Linux/Mac):
Step 2: Create DNS Record
Add a TXT record to your DNS with the selector and public key.
DNS Record Format
Example DKIM Record
Step 3: Configure Mail Server
Configure your mail server to sign outgoing emails with the private key.
Popular Mail Servers
- • Postfix: Use OpenDKIM or rspamd
- • Exim: Built-in DKIM support
- • Sendmail: Use dkim-milter
- • Exchange: Built-in DKIM signing
DKIM Record Not Found
The DNS lookup for selector._domainkey.domain returns no results.
Solution: Verify the selector name and ensure the DNS record is properly published.
Invalid Public Key Format
The public key in the DNS record is malformed or contains invalid characters.
Solution: Regenerate the public key and ensure proper base64 encoding without line breaks.
Key Length Too Short
Using RSA keys shorter than 2048 bits is considered insecure.
Solution: Generate new 2048-bit or 4096-bit RSA keys for better security.
Signature Verification Failures
DKIM signatures are failing verification at receiving mail servers.
Solution: Check private/public key pair match, verify mail server configuration, and test canonicalization settings.
Wrong Selector or Missing Key
The public key can't be found at the expected selector location.
Solution: Confirm the selector with your email provider and publish the correct TXT record.
Key Mismatch
The public key doesn't match the private key used for signing.
Solution: Publish the public key that corresponds to the private key used by your mail server.
Headers Modified by Forwarding
Signature validation can fail after an email is forwarded and headers change.
Solution: Use ARC or relaxed canonicalization to preserve authentication across forwarding.
DKIM Testing Tools:
Send Test Email
Send an email to a test address and check headers for DKIM-Signature
Mail-Tester.com
Send email to their test address for comprehensive DKIM analysis
Gmail Headers
Check "Show original" in Gmail to view DKIM verification results
Command Line
Use dig or nslookup to verify DNS record publication
What is a DKIM selector?
A selector is a unique identifier that allows you to have multiple DKIM keys for the same domain. It's used in the DNS record name (selector._domainkey.domain.com) and in the DKIM signature header.
Can I use the same DKIM key for multiple domains?
While technically possible, it's not recommended for security reasons. Each domain should have its own unique DKIM key pair to maintain proper isolation and security.
How often should I rotate DKIM keys?
It's recommended to rotate DKIM keys annually or whenever there's a security concern. When rotating, publish the new key first, then update your mail server configuration, and finally remove the old key after a grace period.
What happens if DKIM verification fails?
DKIM failure doesn't automatically mean email rejection. The receiving server may still deliver the email but mark it as potentially suspicious. The final action depends on the recipient's DMARC policy.
Do I need DKIM for every subdomain?
Only subdomains that send email need DKIM records. Each sending subdomain should have its own DKIM configuration, as DKIM records don't inherit from parent domains.
Can I have multiple DKIM records for one domain?
Yes, you can have multiple DKIM records using different selectors. This is useful for key rotation, different mail servers, or third-party email services that require their own DKIM keys.
What does DKIM stand for?
DomainKeys Identified Mail - an email authentication method that uses digital signatures.
Where is the DKIM public key published?
In DNS as a TXT record at selector._domainkey.yourdomain.
Does DKIM encrypt my email?
No. DKIM signs the message to prove integrity and authenticity; it does not encrypt content.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.