Question 1

What is DKIM?

Accepted Answer

DKIM stands for DomainKeys Identified Mail. It is an email authentication method designed to detect forged sender addresses in emails (email spoofing). It allows the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.

Question 2

How does DKIM work?

Accepted Answer

DKIM adds a digital signature to the headers of an email message. This signature is generated using a private key, which is kept secret by the sending mail server. The corresponding public key is published in the domain's DNS records. When a receiving mail server gets the email, it can use the public key from the DNS to verify the signature. A successful verification proves that the email hasn't been tampered with and originated from the authorized domain.

Question 3

What is a DKIM selector?

Accepted Answer

A DKIM selector is a specific string used to identify a particular DKIM public key in a domain's DNS. A single domain can have multiple DKIM keys for different sending services (e.g., Google Workspace, Mailchimp). The selector allows the receiving server to know which public key to use for verification. It's part of the DNS record location, like `selector._domainkey.example.com`.

Question 4

How do I find my DKIM selector?

Accepted Answer

Your DKIM selector is provided by your email sending service (e.g., Google Workspace, Microsoft 365, SendGrid). You'll typically find it in the admin console of that service, in the section for email authentication or DKIM setup. Common selectors are 'default', 'google', or service-specific names. You can also analyze the email headers of a message sent from that service to find the `s=` tag in the `DKIM-Signature` header.

Question 5

Why do you need DKIM, DMARC, and SPF checks?

Accepted Answer

SPF, DKIM, and DMARC are three core email authentication protocols that work together. SPF declares which IPs can send email for your domain. DKIM provides a cryptographic signature to verify the message integrity. DMARC builds on both, telling receiving servers how to handle failures and providing crucial reports. Using all three provides a comprehensive defense against spoofing, phishing, and fraud, while also improving your email deliverability.

Question 6

Why does DKIM lookup matter?

Accepted Answer

A DKIM lookup is essential to verify that your public key is correctly published in your DNS and is syntactically valid. If the record is incorrect, missing, or the key is too short (e.g., less than 1024 bits), receiving mail servers cannot verify your emails, leading to DKIM failures. This can hurt your deliverability and leave you vulnerable to impersonation.

Question 7

What are some common DKIM issues?

Accepted Answer

Common issues include: the DKIM record not being published in DNS, typos in the record name or content, using a key that is too short (less than 1024-bit), the public key in DNS not matching the private key used for signing, or having multiple records for the same selector.

Question 8

How to check DKIM via 'nslookup' or 'dig'?

Accepted Answer

You can use command-line tools. For `dig`, use: `dig selector._domainkey.yourdomain.com TXT`. For `nslookup`, use: `nslookup -q=TXT selector._domainkey.yourdomain.com` (you may need to specify a DNS server like 8.8.8.8). Replace 'selector' and 'yourdomain.com' accordingly.

Question 9

How do I test my DKIM key?

Accepted Answer

The best way to test your DKIM key is to send an email from the service that uses it and analyze the headers on the receiving end. Look for an `Authentication-Results` header. A result of `dkim=pass` means your key is working correctly. Our DKIM Lookup tool also validates that the key is published correctly in DNS.

Question 10

How long does it take to set up DKIM?

Accepted Answer

Setting up DKIM is usually quick. The process involves generating the key pair from your email service provider and adding the public key as a TXT record to your DNS. The main delay is typically DNS propagation, which can take anywhere from a few minutes to 48 hours, though it's often much faster.

Tag	Description
v	The version tag. The value should always be `DKIM1`. If it's missing or incorrect, the record will be ignored.
p (required)	The public key tag contains the base64-encoded public key data. This is the most critical part of the record. If this value is empty, the DKIM record is effectively revoked.
k	The key type tag, which defaults to 'rsa'. It's crucial that both sending and receiving servers support this key type. 'rsa' is almost universally supported.
h	This tag defines the acceptable hash algorithms that can be used. The default is 'sha256'. It's a colon-separated list (e.g., sha1:sha256).
s	This tag specifies the service types this record applies to. A value of `*` means it is for all service types. If a specific service type is listed, it only applies to that service.
t	A colon-separated list of flags. The most common flag is 'y' (for 'testing'), which indicates the domain is still testing DKIM. Another flag is 's', which indicates that the DKIM signature's domain must be the same as the From: header domain.
n	An optional note field for administrators, intended for human-readable comments.

DKIM Record Lookup

DKIM Tag Explanations

DKIM Frequently Asked Questions

Discover All Our Tools

Lookup Tools

Other Tools