DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outgoing mail, generated with a private key your sending platform controls. Receivers fetch the matching public key from your DNS and verify the message wasn't altered in transit and really was signed by something with access to that private key.

Selectors

The public key lives at a DNS name like selector1._domainkey.yourdomain.com. The "selector" part is chosen by your sending platform, not standardised — Microsoft 365, Google Workspace and most CRM/marketing platforms each use their own selector names, and some rotate them. This is why checking for DKIM is fundamentally different from checking for SPF or DMARC: there's no single well-known DNS name to look up.

Why "no DKIM found" isn't the same as "no DKIM"

A scanner can only check selectors it knows to try. If none of those match, the honest result is unknown — not "DKIM is absent." A domain can have DKIM correctly configured with a selector no public tool has guessed. If you know your provider, checking your provider's DKIM setup page directly is more reliable than any external scan.

Getting a key

You cannot invent a DKIM key yourself and publish it — the private key must be generated by the platform actually signing your mail (your email provider, CRM, invoicing or marketing platform). Each sending service you use needs its own DKIM setup, confirmed with that service, before it will show as authenticated.

Turning it on

Provider steps: Microsoft 365 (Defender portal → email authentication settings) · Google Workspace (Admin console → Gmail → Authenticate email). For anything else, look for "DKIM," "email authentication" or "domain authentication" in that platform's settings.