DKIM, short for DomainKeys Identified Mail, adds a digital signature to every email you send. Receiving servers use a public key published in your DNS to check the signature, which proves the message came from your domain and was not changed along the way.
How DKIM Works
Your email provider signs each outgoing message with a private key that only it holds. The matching public key is published as a TXT record at a name like selector._domainkey.example.com, where the selector is a label the provider chooses. The receiving server reads the selector from the message, fetches the public key and checks the signature. If anything in the signed parts was changed, the check fails.
Selectors and Multiple Keys
Because each key has its own selector, a domain can have many DKIM keys at once, one for each service that sends email for it. Your main mailbox provider might use one selector, and your newsletter service another. Keys can be replaced, or rotated, by publishing a new selector and switching over, without breaking mail in transit.
Key Strength
DKIM keys are usually RSA keys. Keys of 1024 bits are still common but considered weak, and 2048 bits is the recommended size today. A key that is too short, missing or published with a typo means messages cannot be verified, which hurts delivery and makes DMARC harder to pass.
The Domibot DKIM Checker finds your signing keys under common selectors and checks their strength.