DKIM check
Look for DKIM signing on a domain using the most common selectors.
About DKIM check
What it is
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail. The recipient verifies the signature against a public key in your DNS and can then trust that the message was not altered in transit.
Why it matters
DKIM proves that an email genuinely comes from you and has not been tampered with. Together with SPF and DMARC, it is the foundation for your mail being delivered and not forged.
Tips
- Enable DKIM at your email provider (for Microsoft 365 in the Defender portal).
- The selector can vary, common ones are selector1/selector2 for Microsoft 365 and google for Google Workspace.
- Rotate keys from time to time if your provider supports it.
Common questions
What is a DKIM selector?
A selector is the name of the DNS record where the public DKIM key is stored, for example selector1._domainkey.yourdomain.com.
Why is DKIM not always detected automatically?
DKIM can live on a custom selector that cannot be guessed. In that case you need to check the setting at your email provider.
More lookups
MX lookup
See which servers receive mail for a domain, and which provider handles it.
SPF check
Check whether a domain has an SPF record and how strictly it rejects spoofed mail.
DMARC check
See whether a domain has DMARC and which policy it uses against spoofed mail.
DNSSEC check
See whether a domain is protected with DNSSEC, that is, whether its DNS answers are signed.
TXT lookup
List all TXT records for a domain, including SPF, verifications and more.
NS lookup
See which name servers control a domain's DNS.
Blacklist check
Check whether a domain's IP address is on blacklists such as Spamhaus, Barracuda and SpamCop.
A/AAAA lookup
See which IP addresses a domain points to, both IPv4 (A) and IPv6 (AAAA).
CNAME lookup
See whether a domain is an alias that points on to another domain.
SOA lookup
See the zone's core data: primary name server, contact and serial number.
CAA lookup
See which certificate authorities are allowed to issue certificates for the domain.
Reverse DNS (PTR)
Look up which host name a domain's IP address points back to.
MTA-STS
See whether a domain requires encrypted mail delivery via MTA-STS.
TLS-RPT
See whether a domain receives reports about failed encrypted mail delivery.
BIMI
See whether a domain publishes a logo that can be shown in the recipient's inbox.
SSL certificate
Check a domain's TLS certificate: issuer, validity and expiry.
Whois
See who owns a domain, when it was registered and when it expires.
HTTP security headers
Check whether a domain's website sets important security headers.