Question 1

What is DKIM and how does it work?

Accepted Answer

DKIM (DomainKeys Identified Mail) is an email authentication protocol that uses cryptographic signatures to verify email authenticity. When you send an email, your server adds a digital signature to the header using a private key. Receiving servers verify this signature using the public key published in your DNS at selector._domainkey.yourdomain.com. This proves the email wasn't altered in transit and came from an authorized server.

Question 2

How do I inspect my DKIM record?

Accepted Answer

Use our free DKIM Inspector tool above. Enter your domain and DKIM selector (usually 'default', 'google', or 'k1'), and we'll retrieve your DKIM public key from DNS. The tool analyzes key length (should be 2048-bit), algorithm type (RSA recommended), service type, flags, and provides security recommendations based on best practices.

Question 3

What is the recommended DKIM key length?

Accepted Answer

The recommended DKIM key length is 2048 bits for optimal security. Keys should be at least 1024 bits (minimum acceptable), but anything under 1024 bits is considered weak and may be rejected. While 4096-bit keys offer more security, they can cause DNS record size issues. 2048-bit provides the best balance of security and compatibility.

Question 4

Can I have multiple DKIM selectors?

Accepted Answer

Yes, you can have multiple DKIM selectors for the same domain. This is useful when using multiple email services (e.g., 'google' for Google Workspace, 'sendgrid' for SendGrid, 'default' for your own server). Each selector points to a different public key at selector._domainkey.yourdomain.com. Our inspector can check any selector you specify.

Question 5

What does DKIM key rotation mean?

Accepted Answer

DKIM key rotation is the security practice of periodically replacing your DKIM keys with new ones. This limits the damage if a private key is ever compromised. Best practice is to rotate keys every 6-12 months. When rotating, publish the new public key in DNS, configure your mail server to sign with the new private key, then remove the old key after propagation.

DKIM Inspector

DKIM Inspector

Frequently Asked Questions

Related Tools

DMARC Analyzer

SPF Surveyor

Domain Security Checker

Help & Resources

About DKIM

What We Check