DKIM Check — Verify DKIM Signature and Key

What is DKIM?

DomainKeys Identified Mail (DKIM, RFC 6376) cryptographically signs outgoing email. The sending server hashes selected headers plus the body and signs that hash with a private key. The public key is published as a DNS TXT record at selector._domainkey.yourdomain.com.

This lets the recipient prove two things: that the message was authorized by the signing domain, and that it was not altered in transit. Unlike SPF, DKIM survives forwarding because the signature travels with the message rather than depending on the sending IP.

What AnalyzeMy.Email checks

Verification of the signature against the published public key — result pass, fail or none
Algorithm: rsa-sha256 and ed25519-sha256 are considered secure, rsa-sha1 is obsolete
Key strength: 1024, 2048 or 4096 bit for RSA. 1024 bit is treated as too weak and flagged
Signed headers: are From, To, Subject and Date covered by the signature?
Canonicalization: the mode used for headers and body (simple/relaxed)
Domain alignment: does the signing domain (d=) match the From header domain — strict, relaxed or not at all?
Multiple signatures are reported individually, for example when sender and mail gateway sign separately

Why the signed headers matter

A DKIM signature only protects what it covers. If the Subject header is not part of the h= list, an attacker can replace the subject of a signed message without breaking the signature. Equally important: if the From header is not signed, the signature is practically worthless for sender identity — and DMARC alignment never comes about in the first place.

Common failure causes

Body modified: mailing lists and gateways append footers. That breaks the body hash and DKIM fails.
Key rotated, DNS not: the private key was replaced while the public record in DNS still holds the old value.
Selector not found: the signature's s= selector does not exist in DNS — common after a provider migration.
1024-bit keys: many legacy setups still run 1024 bit. 2048 bit is the current standard.
No signature: a result of none means nothing was signed at all. DMARC then falls back to SPF alone.

DKIM Check — Verify Signature, Key Strength and Alignment