Verify your domain's DKIM configuration. Ensure your emails are properly signed and authenticated to improve deliverability and protect against spoofing.
Skysnag takes the complexity out of DKIM implementation and management, ensuring your emails are properly signed and authenticated across all your sending services.
Automated Key Generation
Create strong cryptographic keys without manual intervention
Secure Key Storage
Store private keys securely while publishing public keys to DNS
Scheduled Key Rotation
Automatically rotate keys on a regular schedule for enhanced security
Multi-Service Management
Configure DKIM for all your email providers from a single dashboard
Alignment Monitoring
Ensure DKIM signatures align with your From domain for DMARC compliance
Signature Verification
Continuously test and verify that your DKIM signatures are valid
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to your emails. This signature allows receiving mail servers to verify that the message was sent from an authorized server and hasn't been tampered with during transit.
DKIM adds a digital signature to your emails that receiving servers can verify, proving the message hasn't been altered in transit.
Properly signed emails are more likely to reach the inbox instead of being filtered as spam.
Detect if email content has been modified between sending and receiving, ensuring message integrity.
Build a positive sending reputation for your domain by consistently signing emails with DKIM.
While DKIM is essential for email authentication, implementing it correctly can be challenging. Here are the common obstacles organizations face:
Generating, storing, and rotating cryptographic keys across multiple services
Configuring DKIM for each email service provider separately
Ensuring DKIM signatures align with your From domain
See the impact of proper DKIM implementation with Skysnag
99.8%
signature validation rate
15%
increase in email deliverability
100%
automated key rotation
24/7
signature monitoring
Meet with one of our experts to review your report. We'll walk you through the issues, explain the security gaps, and show you exactly how Skysnag resolves them - automatically.
Discuss my resultsSkysnag gives you everything you need to enforce DMARC, automate SPF and DKIM, deploy MTA-STS and TLS-RPT, and activate BIMI - so your emails are secure, compliant, and trusted.
Monitor
Identify email compromise attempts and troubleshoot email delivery issues
Comply
Comply with Microsoft, Google and Yahoo requirements and visualize sending data in real-time
Protect
Automate DMARC enforcement for unparalleled email security
Certify
Certify your brand with the highest identity standard globally
A DKIM record is a DNS TXT record holding the public key that receivers use to verify a message’s cryptographic signature. It is published at selector._domainkey.yourdomain.com, where the selector identifies which key to use. DKIM proves a message was authorized by the domain and was not altered in transit.
DKIM (DomainKeys Identified Mail), defined in RFC 6376, adds a digital signature to outgoing email. The sending server signs the message with a private key; the matching public key is published in DNS so any receiver can verify the signature.
Because the signature covers the message content and key headers, DKIM proves two things: the message really was authorized by the domain, and it was not modified in transit. Unlike SPF, DKIM survives most forwarding — which is why it is the more reliable of the two methods DMARC depends on.
DKIM uses selectors so a domain can run multiple keys at once (one per sending service, and old/new keys during rotation). To check a DKIM record you need to know the selector, which appears in the s= value of the DKIM-Signature header of a received message.
DKIM records are published per selector, so you need the selector name to look one up. Find it in an email’s headers, then query DNS.
Open a message from the domain, view its original/headers, and find the DKIM-Signature line. The s= value is the selector (e.g. s=google, s=selector1) and the d= value is the domain.
Query selector._domainkey.domain. For selector google on example.com:
$ dig TXT google._domainkey.example.com +shortA valid record contains v=DKIM1 and a p= public key. An empty p= means the key was revoked. Prefer a 2048-bit key over 1024-bit.
$ nslookup -type=TXT google._domainkey.example.comselector1._domainkey.example.comv=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...ABA DKIM public-key record: version DKIM1, RSA key type, and the Base64 public key (truncated) used to verify signatures from this selector.
A DKIM record is a set of tag=value pairs. The key material is in p=.
| Tag | Type | Meaning |
|---|---|---|
v |
Optional | Version. If present, must be DKIM1 and listed first. |
k |
Optional | Key type, almost always rsa. |
p |
Required | The Base64-encoded public key. An empty p= revokes the key. |
t |
Optional | Flags — e.g. y for testing mode, s to forbid subdomain use. |
h |
Optional | Acceptable hash algorithms (e.g. sha256). |
s |
Optional | Service type the key is valid for (default *, all). |
Common DKIM results and what they mean.
| Result | What it means & what to do |
|---|---|
| No record for the selector | Either the selector is wrong, or DKIM is not set up for that service. Confirm the selector from a real message header. |
| Empty p= value | The key has been revoked. Publish a current public key for the selector. |
| 1024-bit key | Works, but weak by modern standards. Rotate to a 2048-bit key. |
| t=y (testing) | Receivers treat signatures as test-only and may ignore failures. Remove once verified. |
A DKIM record is a DNS TXT record containing a public key, published at selector._domainkey.yourdomain.com. Receivers use it to verify the cryptographic signature a sending server adds to each message, proving the mail is authentic and unaltered.
You need the selector. Find the s= value in a message’s DKIM-Signature header, then run dig TXT selector._domainkey.yourdomain.com +short, or use the checker above.
Open a received email, view the original/raw headers, and locate the DKIM-Signature header. The s= tag is the selector and d= is the signing domain. Common selectors include google, selector1/selector2 (Microsoft 365), and k1 (Mailchimp).
Use a 2048-bit RSA key. 1024-bit keys still work but are considered weak; many providers now default to 2048-bit. Rotate keys periodically.
DKIM alignment means the domain in the DKIM signature (d=) matches the visible From domain. DMARC requires SPF or DKIM to both pass and align; a valid DKIM signature from an unrelated domain does not satisfy DMARC.
Yes — one per selector. This is how a domain runs separate keys for different sending services and rotates keys safely without downtime.
