DKIM Checker
Verify your DomainKeys Identified Mail (DKIM) configuration to ensure your emails are cryptographically signed and trusted by receiving servers.
Demystifying DKIM Signatures
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to your emails, guaranteeing to receivers that your message wasn't intercepted or tampered with in transit.
How does DKIM work?
When you send an email, your mail server uses a private key to generate a unique digital signature for that specific message. This signature is attached to the email headers. When the receiving server gets the email, it looks up your domain's DNS to find your public key (the DKIM record) and uses it to verify the signature. If it matches, the email is authentic.
What is a DKIM Selector?
A selector is simply a prefix used to locate the correct public key in your DNS. Because a single domain might use multiple email services (like Google Workspace for staff and SendGrid for marketing), each service needs its own unique key. The selector (e.g., "google._domainkey") tells the receiving server exactly which key to look up.
1024-bit vs 2048-bit Keys
The "k=" tag in your DKIM record defines the encryption type (usually RSA), and the "p=" tag contains the actual public key string. Older systems use 1024-bit keys, but modern security standards strongly recommend upgrading to 2048-bit keys. They are significantly harder for attackers to crack and provide much stronger spoofing protection.
Why is my DKIM failing?
DKIM signatures can break if an email is forwarded or modified in transit (e.g., if a mailing list appends a footer to the body). It will also fail if you rotated your keys in your email provider but forgot to update the corresponding TXT record in your DNS. Always ensure your public key exactly matches the private key signing the emails.