DKIM Lookup
Look up your domain's DKIM record and verify your email signing configuration.
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. The receiving server retrieves the public key from DNS and verifies that the message was not altered in transit and genuinely originated from that domain.
Each outgoing email is signed with a private key only your server knows. The recipient verifies it against the public key published in DNS.
The signature covers the email headers and body. Any modification in transit causes DKIM verification to fail, alerting the recipient.
A valid DKIM signature produces a "pass" result for DMARC policy evaluation, increasing the chance your emails reach the inbox.
DKIM setup involves generating a key pair and publishing the public key in DNS. Most email hosting providers complete these steps automatically.
Generate an RSA (minimum 2048-bit) or Ed25519 key pair via your mail server or email provider. The private key stays on your server; the public key goes into DNS. Choose a selector name (e.g. mail, 2024).
In your DNS management panel, create a new TXT record. Enter selector._domainkey in the host field and paste v=DKIM1; k=rsa; p=PUBLIC_KEY as the value.
selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=..."
After DNS propagation (5–30 minutes), use the tool above to query your DKIM record with your selector and domain. Once confirmed, send a test email to verify the signature.
Key points to keep in mind so DKIM signing works correctly and your emails don't end up in spam.
1024-bit RSA keys are no longer considered secure. Use at least 2048-bit RSA or Ed25519 for new setups. If your existing key is 1024-bit, rotate it by creating a new selector.
Selectors let you run multiple DKIM keys on the same domain — useful for different services or key rotation. Use meaningful names like mail, google, or 2024.
For security, DKIM keys should be rotated every 6–12 months. Publish the new key under a new selector, keep the old record active briefly, then remove it.
DNS TXT records are limited to 255 characters per string. 2048-bit RSA public keys often exceed this; your provider typically splits the key across multiple strings automatically.
Pro ePosta's business email hosting comes with DKIM signing, SPF, and DMARC fully configured out of the box.
