DKIM record checker
Check whether a domain signs its outgoing email with DKIM. We look for keys under the selector names that Microsoft 365, Google Workspace and other big mail services use, and test SPF and DMARC in the same report.
What is DKIM?
DKIM adds a digital signature to every email you send. The receiving server fetches your public key from DNS and checks that the message really comes from your domain and was not changed on the way. The key lives under a selector name:
selector1._domainkey.yourcompany.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg…"
Common selectors
Microsoft 365 uses selector1 and selector2, Google Workspace uses google, and many other services use their own name (k1, s1, mandrill, …). If you know your selector, the email headers of a message you sent show it in the DKIM-Signature line as s=.
Good DKIM practice
Turn DKIM on in every service that sends in your name, not only your main mailbox.
Use 2048-bit keys; 1024-bit keys are considered weak.
Rotate keys once or twice a year. Microsoft 365 and Google Workspace can do this for you.
Questions
- You found no DKIM key. Is DKIM off?
- Not necessarily. A selector can have any name, and DNS cannot list them. Check the DKIM settings of your mail service or the headers of an email you sent.
- Do I need DKIM if I have SPF?
- Yes. SPF breaks when mail is forwarded; DKIM keeps working. DMARC needs at least one of the two to pass and be aligned, and DKIM is the more reliable one.
- Is DKIM the same as encryption?
- No. DKIM proves who sent the message and that it was not changed. It does not hide the content.
OZAG Technologies · KVK 42167370 · Laan van Oversteen 20, 2289 CX Rijswijk · +31 6 24496620 · support@ozagsecurity.com