Free DKIM checker. Is your email sealed?
DKIM is a digital seal that proves your email was not changed and really came from you. Check yours in seconds, with plain-English results.
What the digital seal does
When DKIM is on, your email service adds a hidden digital seal to every message you send. The receiving inbox looks up your seal key in your DNS and checks the seal. A valid seal shows the email was not changed on the way and really came from your domain.
Sealed email is trusted more and lands in spam less often. The seal also lets your DMARC rule pass even when an email is forwarded, which a sender list alone cannot do.
What this check can and cannot see
A seal key is filed under a name your email service chooses, and DNS cannot list every name. We try the names used by Microsoft 365, Google Workspace and common mail services, plus any name you enter. Finding a key shows the seal is set up; it does not prove every email you send is sealed. To check one real email, paste its headers into the email header analyzer.
For everything else about your email setup, run the full email and DNS checker, which includes this seal check.
Common questions
What is a DKIM record, in plain English?
It is a digital seal for your email. Your email service signs each message, and the DKIM record in your DNS holds the public key inboxes use to check that seal. If the seal checks out, the inbox knows the email was not changed and really came from your domain.
What is a DKIM selector or seal name?
It is the name your email service files the seal key under. Microsoft 365 uses selector1 and selector2, Google Workspace uses google, and other services pick their own. You can see the name in an email you sent: paste its headers into our email header analyzer and look for the seal name.
Why does the checker say it could not find a seal?
We try the names used by Microsoft 365, Google Workspace and common mail services. If your service uses a different name, enter it in the seal name box. If the seal is genuinely missing, your emails go out unsigned.
How do I turn on DKIM in Microsoft 365?
In the Microsoft Defender portal, open Email and collaboration, then Policies and rules, Threat policies, and Email authentication settings, where the DKIM tab lets you create keys and turn signing on for each domain. Two CNAME records must be added in your DNS first. We can do this for you remotely.
How do I turn on DKIM in Google Workspace?
In the Google Admin console, open Apps, then Google Workspace, Gmail, and Authenticate email. Generate the record, add it to your DNS, then select Start authentication. We can do this for you remotely.
Related help
Free email and DNS checker
Check your mail servers, SPF and DMARC in seconds, explained in plain English.
Free email header analyzer
Paste an email’s headers to see its route, delays and sender checks, in your browser.
Free SPF checker
See if your approved-sender list exists, is valid and protects your domain.
Free DMARC checker
See whether fake emails using your domain are watched, sent to spam or blocked.
Microsoft 365 administration
Licences, accounts, security settings and the day to day of running a tenant.
Get a quote
Tell us what you need and we will map out the simplest path.
Need a DNS or email problem fixed?
We can investigate your setup and quote a one-time repair, done remotely. If you need continued help, ask about remote IT support.