How to check and set up a DKIM record

DKIM puts a digital signature on every email you send. The matching public key is published in DNS, so receivers can verify that the email was really signed by your domain and wasn't altered along the way.

Check DKIM yourself

Enter the selector(s) of your mail provider, for example google (Google Workspace) or selector1 (Microsoft 365). You can find the selector in the DKIM-Signature header (s=) of a sent email.

How DKIM works

Your email provider signs every outgoing email with a private key and adds a DKIM-Signature header. Among other things, it contains the domain (d=) and the selector (s=). The receiver uses those two to look up the public key in a TXT record at selector._domainkey.yourdomain.com and uses it to verify the signature.

Selectors let you use several keys side by side, for example one for your email provider and one for your newsletter service.

Example DKIM record

google._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"

Finding your selector

You don't choose the selector yourself; your email provider does. A tool can only try common selectors, and yours isn't always among them. You can find it in two ways:

In your email provider's DKIM settings. Common ones are google (Google Workspace) and selector1 and selector2 (Microsoft 365).
In an email you sent yourself: open the original source of the message (in Gmail, "Show original") and look for the DKIM-Signature header. The value after s= is the selector.

Common mistakes

The record is in DNS, but DKIM hasn't been turned on at the email provider yet. In Google Workspace, for example, after adding the record you still have to start authentication in the Admin console.
The key got cut off while copying. 2048-bit keys are longer than 255 characters; some DNS panels automatically split them into several strings within one record, others don't.
The record is on the wrong name, for example google._domainkey.example.com.example.com, because the DNS panel already appends the domain itself.
The test flag t=y was left in place, allowing receivers to ignore the signature.
An outdated 1024-bit key. Generate a new 2048-bit key at your email provider.

DKIM, SPF and DMARC together

DKIM on its own doesn't tell receivers what to do with an email that lacks a valid signature. That's what DMARC is for: an email passes DMARC if the DKIM signature is valid and the domain in d= matches the sender address the recipient sees.

Unlike SPF, a DKIM signature usually stays valid when an email is forwarded. A mailing list that changes the subject or content can, however, invalidate the signature. A valid DKIM signature also doesn't guarantee that your email lands in the inbox.

How SteadyHost rates DKIM

OK: there's exactly one valid DKIM record at the selector, with an RSA key of at least 2048 bits or another key type (such as Ed25519).
Warning: no record was found for the selector, the RSA key is shorter than 2048 bits, or the record is in test mode (t=y).
Problem: multiple records for the same selector, a revoked or invalid key, a key shorter than 1024 bits, or an invalid version.
The full check tries the selectors of common email providers (google, selector1, selector2, k1, default and mail). If your provider uses another one, enter it above. DKIM doesn't count toward the score.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.