What is DKIM, and how do you know it is working?

Somewhere in your email settings, or in a message from your IT person, you have seen the word DKIM. Maybe a checker flagged it. Maybe a customer said your invoices land in spam. You want two answers: what is it, and is ours working?

This guide answers both in plain English. You will not need to touch your DNS to follow it.

DKIM in one sentence

DKIM, short for DomainKeys Identified Mail, is a signature your email system adds to every message it sends, so that the receiving mail server can check two things: that the message really came from a system your domain trusts, and that nobody changed it on the way.

Think of the wax seal on an old letter. Anyone can write your company name on an envelope. Only you have the seal, and if someone opens the letter and reseals it, the receiver can tell.

How it works, without the maths

There are two halves, a private key and a public key.

1. The private key stays with whoever sends your email, for example Google Workspace, Microsoft 365, or the newsletter tool you use. When a message goes out, that system uses the key to sign the important parts: the From line, the subject, the date and the body.
2. The signature travels inside the email, in a hidden header called DKIM-Signature. You do not see it when you read the message, but every mail server can.
3. The public key sits in your domain’s DNS, the public address book for your domain. The receiving server looks it up and uses it to check the signature.

If the signature checks out, the result is a pass. If the message was changed after it was signed, or the key cannot be found, the result is a fail or none.

A domain can have several keys at once, each stored under its own name, called a selector. Your Google mail might use one selector and your invoicing system another. That is normal.

What DKIM does not do

DKIM is useful, but it is often oversold. The standard itself is clear about its limits:

• It does not encrypt your email. Anyone who can read the message in transit still can.
• A failed signature does not, by itself, make the receiver reject the message. What happens next is up to the receiving server, which is where DMARC comes in.
• It does not say a message is safe or honest. A scammer can sign their own email with their own domain perfectly well. DKIM proves who signed it, not that they are nice.

There is one more catch, and it matters most. Microsoft points out that the domain that signs a message does not have to match the domain in the From address. Many email services sign your mail with their own domain until you set up signing for yours. The receiver then sees a valid signature, but from the wrong company. To protect your name, the signature has to be from your domain, and that match is what DMARC checks.

Why Gmail and Outlook now care

Since 1 February 2024, Google has required every sender to Gmail accounts to set up SPF or DKIM. Anyone sending more than 5,000 messages a day must set up both, plus DMARC, and the domain in the From address must line up with the SPF or DKIM domain. Google also says a DKIM key for Gmail must be at least 1024 bits long, and recommends 2048 bits where your provider allows it. Google says longer keys are more secure.

Microsoft is blunt about its own platform: when you use your own domain with Microsoft 365, “no DKIM signing occurs for outbound mail from custom domains” until you configure it. Mail from the built-in onmicrosoft.com address is signed automatically; mail from yourcompany.com is not. Plenty of businesses assume that because they pay for Microsoft 365, DKIM is handled. It often is not.

If your mail lands in spam, our guide on why your email is going to spam covers the wider picture.

Three ways to check DKIM is working

1. Read the result on a real email (five minutes)

This is the most reliable check, because it tests mail you actually sent.

1. From your business address, send a normal email to a personal Gmail account.
2. Open it in Gmail on a computer, click the three dots (More) next to Reply, then Show original.
3. Look for the DKIM line near the top. Google says a working setup shows something like DKIM=pass or DKIM=OK.

Then look at which domain signed it. If the page mentions your own domain, good. If it only mentions your email provider’s domain, the message is signed, but not as you.

Repeat this for every system that sends email as you: your normal mailbox, your website’s contact form, your invoicing or accounting tool, your newsletter service, your booking system. Each one signs separately, and each one can be the one that is broken.

2. Use an outside checker

Our free domain security checker looks up your public email records from outside and tests 18 common DKIM selector names used by well-known mail providers. If it finds a key, it shows which selector it found.

If it finds nothing, that does not prove DKIM is missing. Selector names can be anything, and a key under an unusual name is invisible from outside. That is why our checker reports DKIM for information only and leaves it out of the grade, rather than scoring a guess. The real email test above is the one to trust.

3. Ask your DMARC reports

If your domain already publishes a DMARC record with reporting turned on, mail providers send you regular summaries of who is sending email as you and whether each source passed DKIM. These reports are the best way to find the forgotten system that sends as you but does not sign. They arrive as raw data files, so you will want help reading them. Our post on DMARC none, quarantine and reject explains how reports fit into the bigger plan.

Common reasons DKIM fails

When a check says fail, it is usually one of these:

• Signing was never switched on for your domain, only for the provider’s own domain.
• A new tool was added (a CRM, a shop, a newsletter) and nobody set up its key.
• The DNS record was changed or deleted, often during a website or hosting move.
• The message was changed on the way. Microsoft notes a signature stays valid only while systems in between do not modify the signed parts. Some forwarding services and mailing lists add footers or rewrite subjects, which can break it.
• The key is too short or very old. Ask your provider what length they use.

What to ask your IT person or email provider

You do not need to fix DKIM yourself. You do need to ask the right questions:

1. Which systems send email using our domain, and is DKIM switched on for each one?
2. Is each one signing as our own domain, not just the provider’s?
3. What key length are we using? Is 2048 available?
4. When were the keys last changed, and who will notice if one stops working?
5. Do we have DMARC reports coming in, and does anyone read them?

If nobody can answer the first question, that is the real finding.

Want us to check yours?

Start with the free domain security checker. It reads your SPF, DMARC and other public records and tells you what it finds in plain English.

If you want someone to find every system that sends as you, make sure each one signs with your own domain, and take you safely to full DMARC protection, that is our domain and email security service.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, IETF. Source for the definition, selectors for several keys per domain, no encryption, and a failed signature not forcing rejection.
• Email sender guidelines, Google Workspace Admin Help. Source for the 1 February 2024 requirements, the 5,000 messages a day threshold, From domain alignment, and the 1024-bit minimum and 2048-bit recommendation.
• Set up DKIM, Google Workspace. Source for checking a message with Show original and looking for DKIM pass.
• How to use DKIM for email in your custom domain, Microsoft Learn. Source for how signing works, the signing domain not having to match the From domain, no signing for custom domains until configured, and signatures breaking when signed parts are modified.