What DKIM does
DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. Your mail server or email service signs the message with a private key, and publishes the matching public key in DNS. The receiving server fetches that key, checks the signature, and confirms two things: the message was not changed in transit, and it was signed by the domain named in the signature.
DKIM is the most dependable way to pass DMARC, because the signature survives forwarding in most cases, while SPF often breaks when mail is forwarded. Make sure the signing domain matches your From domain, then confirm your policy with the DMARC checker.
Selectors and where to find yours
A domain can have many DKIM keys, one for each service that signs its mail. Each key sits under a name called a selector, at selector._domainkey.yourcompany.com. There is no way to list all selectors from DNS, so a checker either tries common ones or needs you to supply the name.
Our check tries the selectors used by common providers automatically. If yours is custom, type it into the selector field in the check form above. To find it, open a message you sent, view the original headers and look at the DKIM-Signature line. The s= tag is the selector and the d= tag is the signing domain.
| Service | Typical selector |
|---|---|
| Google Workspace | |
| Microsoft 365 | selector1 and selector2 |
| Mailchimp | k1, k2, k3 |
| Many other sending services | s1 and s2, or random strings set during domain setup |
How to check DKIM manually
- 1 Find the selector in the s= tag of a DKIM-Signature header from one of your messages.
-
2
Run
dig +short selector._domainkey.yourcompany.com TXT, replacing selector with yours. Some providers use a CNAME that points to their own key. -
3
Confirm the record contains
v=DKIM1,k=rsa(or ed25519) and a longp=value. -
4
Send a test message to a Gmail address, open Show original and look for
dkim=passwithheader.d=yourcompany.com. - 5 Repeat for each service that sends as your domain.
What the results mean
| Finding | Meaning | Fix |
|---|---|---|
| Key found, 2048-bit | Healthy setup | Nothing to do, rotate keys periodically |
| Key found, 1024-bit | Accepted but weaker than recommended | Move to 2048-bit at your next rotation |
| Empty p= value | The key was revoked on purpose | Publish a current key or remove the selector from use |
| No record at selector | Wrong selector or the key was never published | Check the selector in your headers and publish the key your provider gives you |
| Syntax error | Broken quotes, line breaks or extra spaces from a DNS panel | Paste the key again as one value, splitting long keys only into quoted strings |
DKIM alignment and the bulk sender rules
A DKIM pass only helps DMARC if the signing domain (d=) matches your From domain, either exactly or as a subdomain under relaxed alignment. Many email services sign with their own domain by default. Your mail then shows dkim=pass, but DMARC still fails because the domains do not match. The fix is to set up custom DKIM in the service, which gives you a key to publish under your own domain.
Since February 2024, Gmail and Yahoo require bulk senders (over 5,000 messages a day to their users) to sign with DKIM, publish SPF and DMARC, and pass DMARC alignment. Microsoft requires the same for high volume senders to Outlook.com since May 2025. Check SPF alongside DKIM with the SPF checker.
Common DKIM problems
- A new email tool was added without setting up custom DKIM, so its mail fails DMARC.
- A key was rotated at the provider but the old DNS record was removed too early.
- The DNS panel split the key with extra quotes or spaces.
- A mailing list or footer tool changed the message after signing, breaking the signature.
- A key shorter than 1024 bits, which many receivers treat as invalid.
Watch DKIM for every sender
DKIM fails quietly. Nothing bounces, and you only notice when DMARC reports or open rates drop. BlacklistMonitoring rechecks DKIM records for every selector you add, alerts you when a key disappears or changes, and on Business and higher plans uses DMARC aggregate reports to find every service sending as your domain and whether its DKIM aligns. Read about DMARC monitoring and the DMARC report analyzer, or see the pricing page.
Frequently asked questions
How do I check if DKIM is working?
Send a message to a Gmail address and open Show original. Look for dkim=pass with your own domain. You can also enter your domain and selector in the checker above to validate the published key.
How do I find my DKIM selector?
Open the headers of a message you sent and find the DKIM-Signature line. The s= value is the selector and d= is the signing domain. Your email provider's DKIM setup page also shows it.
What DKIM key length should I use?
Use 2048-bit RSA keys where your DNS provider allows it. 1024-bit keys are still accepted by Gmail and others but are weaker. Keys shorter than 1024 bits should be replaced.
Why does DKIM pass but DMARC fail?
The message is signed by a different domain than your From address, usually your email service's own domain. Set up custom DKIM in that service so it signs with your domain, and DMARC will align.
Can I have more than one DKIM record?
Yes. Each sending service should have its own selector and key. Multiple DKIM records under different selectors are normal and do not conflict.