Email Authentication
DKIM record check
DKIM puts a tamper-proof signature on every email you send. Receivers use it to prove the message really came from you.
Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.
What we look at
DKIM keys live at a name only your provider knows (the selector), so we try the ones mail services use: your mailbox provider's first (selector1._domainkey for Microsoft 365, google._domainkey for Google Workspace), then about twenty common ones. We check that the key we find is not empty or revoked and is not a short RSA key under 1024 bits. A key at a selector we do not try will not be found, which reads as missing.
Why it matters to your business
SPF can break when mail is forwarded. DKIM survives forwarding, which makes it the signature DMARC relies on most. Without it, legitimate mail from you is easier to mistake for spam, and you cannot move DMARC to a policy that blocks forgeries without risking your own mail.
How to fix it
- Turn on DKIM signing in your mail provider's admin console: for Microsoft 365, the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM; for Google Workspace, the Google Admin console under Apps → Google Workspace → Gmail → Authenticate email.
- Publish the CNAME or TXT records the provider gives you, then switch signing on.
- Do the same for every other service that sends as your domain; most offer a DKIM setup page.
If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.
Keep an eye on it
A one-off check tells you how things stand today. On Starter and up, DomainGuard re-checks the domains it watches every day and alerts you in the app when something important changes, so you hear about it before a customer does.