DKIM signs outgoing messages. The signing domain publishes a public key; the private key stays with the sending service. Never paste a private key into a DNS record or support form.
- Open the original headers of a message sent through your provider. Locate DKIM-Signature. The
d=value is the signing domain;s=is the selector. Your provider’s DKIM setup screen can also supply both. - Enter that domain and selector in the DKIM checker. It queries
selector._domainkey.domain. Only that selector is checked; absence does not mean all DKIM is missing. - Publish the provider’s exact TXT or CNAME instructions. Some DNS editors append the zone name automatically, so check that you did not enter the domain twice.
- If the result contains an empty
p=, the key is revoked. If it is cut off or malformed, copy the complete provider-generated public value. Plan key rotation with your provider; retain old keys while in-flight messages may need them. - Enable signing in the provider’s admin console, then send a fresh message. Confirm
dkim=passin Authentication-Results and check the signing domain.
A published key alone does not prove the service signs messages. The checker inspects key publication and basic key structure; it does not validate a message signature.
References: DKIM, RSA key requirements and Ed25519 keys.