A DKIM checker looks for the public DNS record that lets receiving mail systems validate a digital signature on messages sent from your domain. It is useful for finding a missing, malformed, or inaccessible record, but a positive result is only one part of a healthy email setup.
What a DKIM record does
DKIM uses a private key at the sending service and a public key published in DNS. When a message is signed, a receiving system can use the public key to verify that relevant parts of the message were not changed after signing. The public key is usually published under a selector, which is a label chosen by the sending platform.
A checker can show whether a record is visible for the selector and domain you query. It cannot automatically prove that every message from every platform uses that selector correctly.
Find the right selector first
Businesses often use more than one email platform: a mailbox provider, CRM, newsletter service, help desk, invoice tool, or ecommerce system. Each may have its own selector and signing configuration. Start with a sender inventory, then find the selector used by the platform you are checking. A message header or the provider’s configuration guidance can help identify it.
What is a DKIM selector explains where the selector fits, and how to check a DKIM record provides the step-by-step process.
How to interpret a checker result
A visible public key is a good sign, but it is not a complete deliverability verdict. Compare the record with the provider’s current setup instructions and confirm that the sending service is actually signing live mail. After an email-platform migration or DNS move, send a real test message and inspect its authentication result.
If the checker cannot find a record, do not immediately replace DNS values. Confirm the selector, authoritative DNS provider, and whether the vendor uses a different signing domain. A rushed change can overwrite another service’s record or leave legitimate mail unsigned.
DKIM works with SPF and DMARC
DKIM is strongest when used alongside SPF and DMARC. SPF authorizes sending infrastructure; DKIM signs mail; DMARC checks whether authentication aligns with the visible From domain and tells recipients how to handle failures. A passing DKIM record does not prove SPF is correct, that DMARC alignment passes, or that messages will reach the inbox.
Review SPF versus DKIM versus DMARC to see the relationship. If you are moving toward DMARC enforcement, use reports to find legitimate senders before tightening policy. DMARC policy choices explains the safe sequence.
Safe troubleshooting sequence
- Identify the platform and selector involved.
- Check the public record and save the existing DNS value.
- Confirm the provider’s published configuration requirements.
- Send a real test message and inspect the authentication result.
- Recheck after DNS propagation, then document the ownership of the selector.
For example, a company’s newsletter platform begins failing DKIM after a DNS migration. The team sees no record under a guessed selector and prepares to add one. A review of the message header reveals the platform uses a different selector; the record was simply omitted from the new DNS zone. Restoring the correct value fixes the issue without touching the company mailbox configuration.
Common mistakes
- Checking a guessed selector: use a real message or provider documentation.
- Assuming one record covers every sender: each platform may sign differently.
- Changing DNS without a backup: save existing values before edits.
- Ignoring alignment: a signature can pass while DMARC still fails.
- Never retesting after changes: check a live message after migrations and vendor updates.
Next step
Run Beacon’s free domain check for a public SPF, DKIM, and DMARC baseline. Keep the result with your sender inventory so future platform changes do not become an email-delivery surprise.
Frequently asked questions
Does a DKIM checker prove every email passes DKIM?
No. It evaluates the public record for the selector checked. A live message test is needed to confirm a specific sender signs correctly.
Can I have more than one DKIM selector?
Yes. Different sending platforms commonly use different selectors.
Should I delete old DKIM records?
Only after confirming the related sender no longer uses them. Removing an active selector can break legitimate mail.