What is DKIM?

DomainKeys Identified Mail (DKIM) adds a digital signature to outgoing e-mail. The receiving mail server looks up the corresponding public key in DNS - published as a TXT record at selector._domainkey.yourdomain.com - and uses it to verify the message wasn't altered in transit and really was signed by a server your domain authorised.

Why we ask for a "selector"

Unlike SPF or DMARC, a DKIM record doesn't live at one fixed, guessable name - the "selector" (the part before ._domainkey) is chosen by whoever set it up, and can be anything. If you don't know it, this check first looks at this domain's own SPF record: the mail services listed there (Google, Microsoft, and others) usually have a documented or observed selector convention, so that's tried first and in full - a domain can genuinely have more than one active at once, for example a main provider plus a separate newsletter tool. Only if that yields nothing does it fall back to a broader, slower sweep of common selectors, which is inherently best-effort: it cannot prove a DKIM record doesn't exist, only that none of the selectors it tried matched.

What this tool can't do for you

We can't generate a DKIM key here, and wouldn't want to even if we could - the private half of that key has to be created and held by whichever server actually sends your mail, so it can sign outgoing messages. Setting up DKIM is something to do with your mail provider (Google Workspace, Microsoft 365, your own mail server's software, and so on); this page only checks whether a record is already published.