DKIM signs each message with a private key and publishes the public one in your DNS, so the receiver verifies the mail left your domain and was not altered in transit. WebMon validates your signatures, watches the keys and reminds you when to rotate them.
Home · Email security · DKIM
In short
DKIM (DomainKeys Identified Mail) is a public standard that adds a digital signature to each message's header. The public key is published in a TXT record under a selector, such as selector._domainkey.yourdomain.
The sending server signs parts of the message with its private key. The receiver fetches the public key from DNS, verifies the signature and confirms the content did not change since sending. If the signature fails, the mail is treated as suspicious.
Any domain that wants deliverability and protection: it is a de facto requirement of major providers and one of the two mechanisms DMARC requires to authenticate mail.
It prevents an intermediary from altering the message content undetected and provides the domain alignment DMARC needs to block spoofing of your brand.
Capabilities
Why it matters
FAQ
It is the label identifying which public key to use; it is published as selector._domainkey.yourdomain. It allows several active keys and eases rotation without interrupting sending.
A good practice is to rotate them periodically, typically every few months, publishing a new selector before retiring the previous one so signatures in transit are not broken.
It is usually due to badly published public keys, a nonexistent selector, or intermediaries that modify the header or body after signing. WebMon identifies which of these causes applies.
WebMon validates your signatures, verifies selectors and key length, and alerts you when to rotate, backed by the SGS 24/7 SOC on its own datacenter in Costa Rica.
Diagnose your domain with WebMon and validate your DKIM signatures and selectors.
Diagnose your domain with WebMon