A DKIM record can be correct on launch day and still become a delivery risk later. Selectors are rotated, sending vendors change signing infrastructure, DNS records expire during migrations, and a new platform may send without your domain authentication. Monitoring DKIM gives you early visibility into these changes so legitimate mail keeps an aligned signature and unexpected changes are investigated before they affect trust.
What you should monitor
Track every active DKIM selector, the hostname where its public key is published, the sender or vendor that owns it, and whether the record resolves. Record the signing domain used in real messages as well as the DNS value. A monitoring process should detect a missing selector, an altered key, an unexpected new selector, a record that is malformed, or a provider configuration change that stops signing mail with your domain.
DNS is only half the picture
A public DKIM record proves a key is available, but it does not prove an application signs messages correctly. Test a real message from each important platform and inspect the authentication results. The email-header guide shows where to find a DKIM pass and the signing domain. Combine that evidence with public DNS checks rather than relying on one source alone.
Track selectors and owners
A selector is the label that directs receivers to a public key, such as marketing._domainkey.example.com. The selector may change when a vendor rotates keys or when different systems sign separately. Keep a register listing the platform, owner, selector, signing domain, DNS provider, and most recent test date. The DKIM selector explainer provides the vocabulary your team needs for that register.
Watch vendor and migration events
Review DKIM after moving DNS, changing email-service providers, creating a new transactional stream, switching marketing platforms, or changing an agency. These are the moments when a provider may need a new CNAME or TXT record, or when an old key can be retired. Do not delete an established selector until you have confirmed that no legitimate message still uses it and that the replacement is passing.
Check alignment, not only signatures
DKIM supports DMARC when the passing signature aligns with the domain in the visible From address. A third-party signature can pass technically while remaining unrelated to your brand. Read the DKIM alignment guide before treating every pass as a DMARC success. Monitoring should capture the d= domain from headers, not just whether a selector exists.
Make alerts actionable
When a DKIM record changes, save the old and new values, note the hostname and timestamp, and ask the designated sender owner whether the change was planned. Then send a controlled test and compare the DKIM, SPF, and DMARC results. An alert without ownership context creates noise; an alert tied to a sender inventory becomes a quick, defensible investigation.
Common errors to avoid
Do not reuse a selector’s record for an unrelated provider, publish a key in the wrong DNS zone, remove old keys immediately after a vendor change, or assume a DKIM pass means mail is aligned. Avoid sharing private keys in tickets or documentation; only the public key belongs in DNS. If a signature fails, work from a recent message and the provider’s current setup instructions.
A simple recurring review
Monthly, confirm that listed selectors resolve, compare recent headers from major senders to your register, review DNS alerts, and investigate any unexpected signing domain. Repeat the review after material changes. The DKIM failure guide helps isolate common causes, and Beacon’s free domain check provides a quick public-record baseline for the review.