What we offer

NEW CASE
Antana

We create digital solutions that work for businesses

Become a clientBecome a client
Give us a call +38 (066) 35-14-529

Let's take the first step towards your website — write to us

Close
Tools

DKIM Lookup

Email

You may also like

The domain DKIM key by selector.

What DKIM does

A digital signature in the message headers. It proves the mail really came from your domain and was not altered in transit.

Signed with a private key Your server signs the message with a key only it holds. Forging that signature without the key is not possible.
Verified with the public key The recipient fetches the public key from your domain DNS and verifies the signature. That key is what the check above looks up.
Tamper protection If someone swaps a link inside the message the signature stops matching and verification fails.
The selector One name, one key. This lets you keep separate keys per service and rotate them without stopping mail.

Why a signature fails verification

The key is not published The sending service generated a key but nobody added the DNS record. The most common cause, and only a check reveals it.
A mailing list modifies the message Some lists append a footer or rewrite the subject. After that the signature no longer matches.
The key is too short 1024 bits is now considered weak. The current standard is 2048, and some receivers ignore shorter keys entirely.
The record is split A long key is split across chunks in DNS, and copying it easily drops a character. The signature then cannot be read at all.

DKIM and SPF are not interchangeable

They check different things, and only the combination gives solid protection.

SPF

Where it came from

Checks the sending server address against a list in DNS.

  • Breaks on forwarding
  • Blind to content changes
+
DKIM

What is inside

Checks that the content has not changed since signing.

  • Survives forwarding
  • Independent of the sending IP

DMARC treats a message as authentic if at least one check passes and its domain matches the From header. That is why both are configured.

DKIM lookup by selector

A DKIM signature proves an email was really sent from your domain and not altered in transit. The public key lives in DNS at selector._domainkey.domain. Enter the domain and selector (e.g. default, google, s1) — and the service shows whether the key is published and its contents.

Where to get the selector? The mail service issues it during setup: in Google Workspace it is usually google, at mail hostings — default or mail. You can also see the selector in the headers of any sent email in the DKIM-Signature field (s= parameter). If there is no key, mail is unsigned and lands in spam more often.

FAQ

What is DKIM?
DKIM (DomainKeys Identified Mail) is a digital signature the mail server adds to emails. The recipient verifies it with a public key from DNS to ensure the email is not forged.
What is a DKIM selector?
A selector is a name (e.g. default, google, mail) marking a specific DKIM key in DNS. One domain can have several keys with different selectors.
Where to get the selector?
The selector is set by the mail service during setup. You can see it in a sent email header in the DKIM-Signature field (s=...).
Why DKIM together with SPF?
SPF checks the sending server, DKIM checks the email integrity. With DMARC they give maximum protection against email forgery.
Telegram Viber Call us