Guide
What is DKIM?
DKIM adds a cryptographic signature to outgoing mail. The receiver fetches your public key from DNS and verifies the signature, which proves the message really came from your domain and was not altered on the way.
How the signature works
Your sending server signs a set of headers and the message body with a private key, and adds the result as a DKIM-Signature header. That header names the signing domain (d=) and a **selector** (s=).
The receiver looks up a TXT record at <selector>._domainkey.<domain> to get the matching public key, then verifies. A pass proves two things at once: the message came from someone holding the private key, and the signed parts were not modified in transit.
Why selectors exist
A selector is just a label, which lets one domain publish several keys at once. That is what makes key rotation possible without downtime — publish a new selector, switch the signer to it, and remove the old key once no mail in flight still uses it.
Different providers use their own conventions: Google Workspace uses google, Microsoft 365 uses selector1 and selector2, Mailchimp uses k1.
DKIM survives forwarding, and SPF does not
When a mailing list or a forwarding address relays your message, the connecting server is no longer yours, so SPF fails. The DKIM signature travels with the message and still verifies — as long as nothing rewrote the signed headers or the body.
This is why a domain relying on SPF alone sees mail fail authentication the moment recipients forward it.
Example
A published key, and the header that points at it
google._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..." DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; h=from:to:subject; b=...
You cannot list your own selectors
DNS offers no way to enumerate the names under _domainkey, so no tool — including this one — can tell you which selectors a domain has published. Every DKIM checker works by guessing the selector names that common providers use. A key published under a custom selector is invisible to all of them, which means "no DKIM found" sometimes just means "not found at the names we tried". If you know your selector, check it directly.
Probe the common selectors on your domain.
Check a domain