DKIM (DomainKeys Identified Mail) is an email authentication method that lets a sending domain digitally sign outgoing messages. The signature proves the email genuinely came from that domain and wasn't altered in transit — it's a core building block of modern email trust, alongside SPF and DMARC.
When an email is sent, the sending mail server generates a cryptographic signature of parts of the message (headers and body) using a private key that only the sender holds. This signature is added to the email as a DKIM-Signature header. The receiving server then looks up the corresponding public key in DNS — published as a TXT record — and uses it to verify the signature matches. If it does, the message is confirmed to be unaltered and genuinely from that domain.
DKIM records are published at a hostname like selector._domainkey.yourdomain.com, where selector is an arbitrary name chosen by whoever configured DKIM (e.g. google, s1, k1, or default). Because the selector isn't standardized, you need to know it (or check your email provider's setup docs) to look up the correct DKIM record — checking default._domainkey.yourdomain.com is a common first guess, which is what most bulk DKIM checkers do by default.
The most common DKIM problems are: the DNS record was never published (email provider generated a key pair but the TXT record wasn't added), a typo in the selector or public key when copying from provider instructions, or key rotation — providers occasionally rotate DKIM keys, and if the old TXT record is removed before the new one propagates, signing can temporarily break.
If you manage email authentication for several domains, our Bulk DKIM Checker lets you verify the default selector across all of them in one pass, so you can spot missing or broken DKIM setups quickly.