DKIM selectors

What this check looks at

Authentication group · check id dkim · all thirteen checks

“DKIM signs your mail cryptographically. We probe the selectors the common providers use.” - the wording shown beside this check while it runs.

DKIM - DomainKeys Identified Mail - adds a cryptographic signature to every message you send. The matching public key is published in your DNS, so a receiver can verify the message really came from you and was not altered on the way.

The key lives under a selector - a short name that lets one domain publish several keys, one per sending service. Google uses google, Microsoft uses selector1 and selector2, and most other providers document their own.

Why it matters

DKIM survives forwarding and SPF does not. When a message is forwarded - a mailing list, an auto-forward from an old address - the delivering server is no longer one of yours, so SPF fails through no fault of anyone. If DKIM is signing, the signature still verifies and the message still passes DMARC. Without DKIM, moving DMARC to reject will eventually bounce legitimate mail that was merely forwarded.

What each verdict means here

Pass

At least one published DKIM key was found.

Warn

Something was found but it is incomplete, empty or malformed.

Fail

No key was found at any selector we know to try. Read the limit below before treating this as proof that DKIM is off.

What to do

1. Turn on DKIM signing in your mail platform - it is a setting, not a purchase, on every mainstream provider.
2. Publish the DNS records that platform gives you, then send yourself a message and check the headers say dkim=pass.
3. Do the same for every other service that sends as you: the invoicing tool, the CRM, the marketing platform. Each one gets its own selector.

What this check does not do

This is a probe, not an audit, and the honest limit matters: DKIM selector names cannot be enumerated from DNS. We ask for the selectors the common providers use. If you sign with a custom selector we do not know, we will report nothing found even though your DKIM is working perfectly. Treat a fail here as "go and look", not as proof.