DKIM Explained: Selectors, Keys and Mail Signatures
Understand DKIM selectors, diagnose missing keys and verify message signatures without confusing DNS lookup with delivery proof.
Login2Cloud product team · Published 2026-10-01
What DKIM establishes
A receiving mail server can verify a message signature against a public key published by the signing domain. A DNS key lookup only establishes that a key record is published; it does not prove a particular delivered message passed verification.
Find the selector
Read the s= selector and d= domain in a real DKIM-Signature header or your mail provider settings. Query selector._domainkey.domain. For selector mail and domain example.com, use mail._domainkey.example.com; guessing selectors is unreliable.
Diagnose common failures
If the record is missing, verify the selector, DNS zone and provider instructions. Check whether a CNAME points to the provider correctly. A malformed key or message modification can break verification even when DNS exists.
Rotate with care
Follow the provider key-rotation process, publish the new selector first and retain old keys for the provider-recommended overlap. Inspect delivered headers for DKIM and DMARC alignment; do not publish private signing keys.
Common questions
Where should I start?
Use the related tool to inspect the current signal, then configure the matching monitor and verify its first result.