Question 1

What is a DKIM record?

Accepted Answer

A DKIM (DomainKeys Identified Mail) record ensures that the email message you sent remains unchanged during transit. It allows the receiving mail server to verify that an email is authentic and actually came from you. When the email server checks your DKIM signature header, it confirms that key components of your email, such as the message body, links, and attachments, have not been tampered with.
 
A DKIM record is a DNS entry in TXT format that contains two critical elements:
 
**Selector:** A string that identifies the specific private key used to sign the email message. This selector is included in the email header along with the signature.
 
**Public Key:** This key is used to verify the signature of the email message, ensuring its authenticity.
 
This record is stored in the DNS server of the domain name used for sending emails, helping maintain the integrity and authenticity of your email communications.

Question 2

What Are DKIM Keys?

Accepted Answer

DKIM keys are part of an email authentication technology that helps verify the authenticity of an email message and prevent email spoofing. There are two types of DKIM keys:
 
**Private Key:** It is generated and stored by the sender's mail server or service provider and used to create a digital signature for outgoing emails.
 
**Public Key:** It is published in the sender's DNS TXT record under their domain name. The recipient's mail server uses this key to verify the signature in the email header.

Question 3

How Does DKIM Work?

Accepted Answer

DKIM works by adding a digital signature to the header of an outgoing message. Here’s a simple step-by-step overview of the process:
 
- The sender’s mail server or service provider generates a digital signature using the private key associated with the sender's domain.
- This signature is added to the email header.
- When the recipient’s email server receives the email, it retrieves the public key from the sender’s DNS record.
- The recipient’s server uses the public key to validate the signature in the email header.
- If the signature is valid, the recipient can be confident that the email is authentic and has not been tampered with during transit.
 
To use DKIM, domain owners must create a pair of public and private keys, publish the public key in a DNS TXT record, and configure their email server to sign outgoing messages using the private key. For those using third-party email service providers (ESPs) like Google, Microsoft, Mailchimp, SendGrid, or Campaign Monitor, the ESP handles the private key and users retrieve the public key from the provider's portal or support team.
 
This process maintains the integrity and authenticity of email conversations, supporting DMARC compliance and improving email deliverability.

Question 4

Is DKIM a part of DMARC?

Accepted Answer

Yes. DKIM is one of two authentication protocols (the other is SPF) that DMARC is based on. At least one of them must pass DMARC's successful verification. Implementing these three standards will significantly improve your deliverability and email marketing results.

Question 5

What's the difference between SPF and DKIM?

Accepted Answer

SPF and DKIM are both email authentication technologies, but they serve different purposes:
 
**SPF (Sender Policy Framework):** Focuses on verifying who (IP addresses) is sending the email. It ensures that the email comes from an authorized IP address for the domain.
 
**DKIM (DomainKeys Identified Mail):** Focuses on verifying what (subject, body, attachments, etc.) is being sent. It uses a digital signature to ensure that the content of the email has not been altered during transit.
 
While both are used to achieve DMARC alignment, DKIM has an advantage over SPF in that its encryption key remains intact even when an email is forwarded. Eventually, both SPF and DKIM are essential for improving email security and deliverability.

Question 6

If I have SPF, do I need to use DKIM?

Accepted Answer

Absolutely. It is highly recommended to use both SPF and DKIM protocols as they play an important role in email authentication and provide a stronger layer of protection against spoofing and phishing attacks.

Question 7

What is a DKIM selector?

Accepted Answer

Your DKIM selector specifies to the receiving mail servers where to look up the DKIM public key in your DNS records. You enter your selector when creating public and private keys using the DKIM wizard when configuring DKIM for your domain.

Question 8

What are DKIM signatures?

Accepted Answer

DKIM signatures use public key cryptography. When you send an email, DKIM creates a cryptographic signature in the header of your message. This encrypted signature contains the “from” address, subject line, message body, and other fields that the domain owner has included in the DKIM TXT record.
 
The DKIM signature is used in combination with the sending mail server's private key and the sender's public key in DNS records to authenticate the email.

Question 9

What is an example of a DKIM signature?

Accepted Answer

A DKIM signature is a header added to an email message, allowing the recipient's email server to verify that the email has not been tampered with.
 
**Here's an example of a DKIM signature header:**
 
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=news;
c=relaxed/relaxed; q=dns/txt; t=1145755832; x=1149019687;
h=from:to:subject:date:keywords:keywords;
bh=MHIzKFY7Kzf3MDAyNzG1Njc5OTAyMjM0MUY3ODlqBLP=;
b=hyjCnOfAKDdLZdKIc9G1q7LoEHiYBiSbzc+yuU2zGrtruF00ldcFVoG4WTHNiYwG
 
Verify your DKIM signature with our free service.

Question 10

How many DKIM records are allowed?

Accepted Answer

There is no limit to the number of DKIM records you can publish for a domain. You can have as many records as you need as long as your DNS hosting allows it. Each DKIM record is associated with a unique selector, which allows you to have multiple DKIM records for different purposes or mail services. This way, you can manage and change DKIM keys without breaking your email authentication setup. However, it's important to manage your DKIM records carefully to avoid any potential conflicts or email authentication issues. Our free online DKIM validation tool is perfect for this purpose.

Question 11

How to find a DKIM selector?

Accepted Answer

The DKIM selector is a string used to identify the public key in a domain's DNS records; it will sign the message in the header. The main purpose of selectors is to permit multiple DKIM keys under the domain name of one organization.
 
You can easily find it, just send a message to yourself and click on “Original Message” to see the full or “raw” header. Search for the “DKIM-Signature”, the selector can be quickly found by the “s=” tag.

Question 12

What is an example of a DKIM selector?

Accepted Answer

Here is an example of a DKIM signature with a selector:
 
DKIM-Signature: v=1; a=rsa­–sha256; c=relaxed/relaxed; d=glockapps.com; **s=s1023g1;**
 
In this example tag “s=” points to “s1023g1” DKIM selector.

Question 13

How to set up DKIM?

Accepted Answer

Setting up DKIM involves several steps to authenticate your domain's email using cryptographic keys. Here's a concise guide on how to do it:
 
**Identify all email sources:** Include all platforms used for sending emails from your domain.
 
**Generate DKIM Keys:** Create a public-private key pair.
 
**Publish the Public Key:** Add the DKIM public key to a DNS TXT record under a subdomain.
 
**Secure the Private DKIM Key:** Safely store and restrict access to the DKIM private key.
 
**Configure Email Server:** Set up your email server or ESP to sign outgoing emails using the DKIM private key.
 
**Test and Monitor:** Use our free DKIM test tool to verify your DKIM record and monitor its performance regularly.

Question 14

How to check the DKIM record?

Accepted Answer

Free DKIM Checker by GlockApps allows you to simply and conveniently look up DKIM records for your sending domain. Our online tool only needs your signer domain and selector name to quickly check that your DKIM record and public key are properly implemented. Then, you will receive a report with the full DKIM record, including tags and explanations.

Question 15

What are the benefits of implementing DKIM?

Accepted Answer

Implementing DKIM ensures that the content of your message with attachments is exactly the same as when you hit the send button. This improves your sender reputation and increases your email deliverability. DKIM works together with SPF and DMARC to provide stronger protection against spoofing and phishing attacks.

Question 16

What are some common DKIM issues?

Accepted Answer

Here are the most common issues with DKIM records:
 
**DNS Configuration Errors:** Proper setup of specific DNS TXT records, including the DKIM public key and policy records, is crucial. Errors such as missing or incorrect records or syntax errors can cause DKIM to fail.
 
**Key Length:** DKIM keys must be at least 1024 bits long, but some email providers require longer keys. Using a key that is too short can result in DKIM failures.
 
**Quoted DKIM Records:** Records mistakenly enclosed in quotes (single or double) are non-compliant with the DKIM specification.
 
**Mismatched Domain Names:** DKIM requires that the domain name used in the DKIM signature matches the domain name in the email's “from” address. A mismatch will cause DKIM to fail, affecting email authentication and DMARC compliance.
 
**Incorrect key pair:** For DKIM to work properly, it is important to generate and use the correct public and private key pair.
 
**Invalid Signing Algorithm:** DKIM supports several signing algorithms, but not all email providers support all of them. Using an unsupported algorithm can cause DKIM to fail.
 
**Message Body Changes:** DKIM signs the email headers and body. If the message body changes after signing, such as passing through a gateway or being modified by a content filter, the DKIM signature will become invalid, causing it to fail verification when received.
 
**Monitoring and maintenance lack:** Neglecting to continually check DKIM authentication can lead to undetected issues and possible failures. Regular maintenance is critical to ensure that DKIM is functioning properly.
 
With our DKIM record validator, you can quickly investigate any issues for free.

Question 17

Is the DKIM Record Checker tool free to use?

Accepted Answer

Yes, our DKIM record checker tool is completely free to use. There are no hidden charges or limitations. Check DKIM for your domain to control security and improve email deliverability.

Free DKIM Record Checker

Free DKIM Checker: Lookup Your DKIM Record, Identify Issues and Fix Them

Keep Your Website Under Control with Our Uptime Monitoring Tool

About the DKIM Checker Tool

Frequently Asked Questions