What is DKIM?
DKIM is a signature a mail service adds to each message it sends for a domain.
Last read from the sources at the foot of this page.
What does DKIM mean?
DomainKeys Identified Mail (DKIM) permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message.
The key sits in the domain's records under a name the mail service chooses, called a selector, such as selector1._domainkey in front of the domain. The service keeps the private half and signs every outgoing message with it.
DKIM survives forwarding better than SPF, because the signature travels inside the message. That is why DMARC accepts either one: a message forwarded by a client's own mail system can still pass on its signature.
A domain whose mail provider was never asked to sign leaves DMARC with one signal instead of two. Turning signing on is usually one setting in the provider's admin console followed by one or two records at the DNS host.
Where does it show up in a reading?
In a LeakTrace reading it is read under “Forged email in your name”: the records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM), read externally.
A key found is read for its strength; one not found at the common names is never called missing, since a service may use a name of its own.
Which pages use this term?
Where does this come from?
- RFC 6376, DomainKeys Identified Mail (DKIM) Signaturesrfc-editor.orgRead 1 November 2026
See what is open before anyone else does.
We read your domain externally and show each way in with a check anyone can re-run.