DKIM record
DKIM adds a digital signature to every email you send, like a wax seal on a letter. Email servers can verify the email really came from you …
Analyse my site for freeUnderstanding "DKIM record"
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email, generated with a private key held by your sending server. The receiving server retrieves the corresponding public key via a specific DNS TXT record and verifies the signature is valid — proving the email wasn't altered in transit and genuinely comes from a server authorised by the domain.
Unlike SPF, which authorises servers by IP address, DKIM authenticates the message content itself via a signature. Both mechanisms are complementary and reinforce each other within the broader DMARC framework.
How TheSiteFuse checks "DKIM record"
TheSiteFuse tests 7 common DKIM selectors (default, google, mail, k1, dkim, selector1, selector2) by querying the TXT record <selector>._domainkey.<domain> for each. The selector is an identifier specific to each sending provider (Google uses google, Microsoft 365 typically uses selector1/selector2…). As soon as a selector returns content, DKIM is considered configured. Known limitation: if your email provider uses a custom selector outside this list of the 7 most common ones, the check may wrongly return a warning even though DKIM is actually active — manually verify with the exact selector provided by your vendor if in doubt.
Why "DKIM record" matters
- Emails more easily marked as spam — major mail providers (Gmail, Outlook, Yahoo) use DKIM's presence as a reputation signal; its absence degrades deliverability of your legitimate emails, independent of any suspicious content.
- Undetectable content tampering — without a signature, a technical intermediary (compromised relay server) could theoretically alter an email's content in transit without the recipient detecting it.
- DMARC prerequisite — a strict DMARC policy (see the dedicated check) requires at least one of SPF or DKIM to be properly aligned; the absence of DKIM reduces your margin if SPF happens to fail for a given use case (email forwarding, mailing lists).
Fix "DKIM record" step by step
Enable DKIM with your email provider
Configuration is almost always done on the provider's side, which generates the key pair and gives you the exact TXT record to add:
# Google Workspace — Admin Console → Apps → Gmail → Authenticate email # Automatically generates the selector and public key to publish # General format of the resulting TXT record Name: google._domainkey.yourdomain.com Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...
Manual verification (replace google with the actual selector provided by your vendor):
dig google._domainkey.yourdomain.com TXT +short
Best practice: rotate the DKIM key every 6 to 12 months to limit the exposure window in case the private key is compromised — most providers offer this rotation automatically.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — DKIM recordDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.