Video transcript

1. 00:00Intro

   Here is how to check a DKIM record, and how to get the format right before you publish one. DKIM signs your outgoing mail with a private key. The matching public key sits in your DNS. The DKIM Checker reads that record live, with no signup. Unlike SPF or DMARC, DKIM has no fixed hostname. So the checker needs your domain and a selector. DNS can't list your selectors. Get yours from your mail provider, or from the s= tag in a real DKIM-Signature header. Enter both, then click Check DKIM.

2. 00:37Read the DKIM record

   The checker found a record for selector google on this domain. Read it from the left. The first tag is the version. k=rsa is the key type. And p is the public key. That key is long, and DNS panels can split long values. A record can look fine in the panel and still be broken. This shows what your DNS actually serves.

3. 00:59DKIM Record Generator

   Publishing a new record? The second tool is the DKIM Record Generator. It doesn't create a key pair. Your mail provider does that, and gives you the selector to use. Enter the selector and your domain, then generate.

4. 01:14Replace the placeholder

   You get two values. The host name is your selector, then _domainkey, then your domain. The value is a format, not a finished record. YOUR_PUBLIC_KEY_HERE is a placeholder. Publish it as it is, and the record won't work. Replace it with the public key from your mail provider. The note shows where to find it in Google Workspace, Microsoft 365, Mailchimp and SendGrid. Publish it as a TXT record. Once it has propagated, run the DKIM Checker again to confirm what's live.

5. 01:46Get started free

   20 free credits every day you use your account, up to 600 a month. No credit card required. Start at billionverify.com.

Featured in this video