DKIM Checker
Cryptographic signing keys for outbound mail, checked against common selectors.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: RFC 6376 — DomainKeys Identified Mail (DKIM)
About this validation
Checks for DKIM signing keys under common selectors.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live DNS TXT-record lookup performed by SEOTechTests against a set of common DKIM selectors. Standard: RFC 6376 defines the DKIM signature and key-record format.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What does DKIM do?
It lets a sending mail server cryptographically sign outgoing email; the receiving server checks the signature against a public key published in DNS to verify the message wasn't altered in transit and genuinely came from a server holding the private key.
Why does this check only look for 'common selectors'?
DKIM keys are published under a selector name chosen by the domain (e.g. "selector1", "google", "default") with no way to discover it from outside -- this check tests a list of widely used selector names, so a domain using an unlisted custom selector may show as not found even though DKIM is actually configured.
What does it mean if no DKIM key is found under common selectors?
Either DKIM isn't configured, or it's configured under a selector this check doesn't try -- it is not a definitive statement that the domain has no DKIM signing at all.
Why is DKIM included in Domain Security Score?
Together with SPF and DMARC, it's one of the three standard mechanisms mail receivers use to judge whether email claiming to be from a domain is authentic, directly relevant to phishing risk.