What Is DKIM, and How Does It Work?
DKIM (DomainKeys Identified Mail) is a DNS TXT record, published at a chosen selector, that holds a public signing key. Outgoing mail is signed with the matching private key; receivers fetch the public key from DNS and check the signature, which confirms two things at once — the message was not altered in transit, and it was sent by something authorized to sign for this domain.
Last updated August 12, 2026.
Why DKIM matters
SPF authorizes sending servers by IP address and DMARC sets a policy for what to do when checks fail, but neither one confirms the message body itself wasn't tampered with in transit. DKIM is the piece that does: a valid signature means the signed headers and body are exactly what left the sending server. It also matters for deliverability — most major mailbox providers use DKIM alignment, alongside SPF, as one of the signals DMARC evaluates.
Where a DKIM record lives
Unlike SPF and DMARC, which live at a fixed, predictable name, a DKIM record's location depends on a selector your mail provider chooses. The full name is:
<selector>._domainkey.<your-domain>
A record there looks roughly like v=DKIM1; k=rsa; p=MIGfMA0G.... The p= tag carries the public key; an empty p= tag means the key has been deliberately revoked (RFC 6376) and mail signed with it can no longer be verified.
How Nivaronix checks DKIM
Nivaronix checks DKIM by querying a fixed list of common selectors — default, google, selector1, selector2, k1, dkim, mail — at <selector>._domainkey.<your-domain> and looking for a TXT record shaped like a DKIM key. It stops at the first selector that resolves. This is a presence check at known selector names, not a directory lookup: DKIM has no public registry of selectors, so a domain signing mail with a selector outside this list will show as "no DKIM record found" even though DKIM is actually configured. Nivaronix also does not validate DKIM signatures on live mail — it does not verify that a specific message was actually signed correctly, only whether a usable public key is published at a selector it checked.
Why selector guessing is the only option
There is no DNS record type or lookup that lists every selector a domain uses — DKIM has no directory service. Every scanner that checks DKIM without asking you for your exact selector, Nivaronix included, works the same way: it tries a short list of names mail providers commonly use (Google Workspace defaults to google, many ESPs default to default or a vendor- specific string, and so on) and reports what it finds at those. Finding nothing at the common names is evidence, not proof, of absence.
Publishing a DKIM record
DKIM key generation and the exact selector name are controlled by your mail provider, not something you invent yourself — check their DKIM setup page (Google Workspace, Microsoft 365, and every major ESP publish one). The provider gives you a selector and a public key; you publish that as a TXT record at <selector>._domainkey.<your-domain> and enable signing on their side.