DKIM record not found? How to check and turn it on

If your CyberVigil report says "DKIM not detected," start by checking, not changing. DKIM may already be on under a name our scan didn't try. The quickest way to know is to look in your email provider's admin settings, which takes a few minutes.

If it turns out DKIM is off, turning it on is a short job: generate a key, add one DNS record, and click a button.

What does "DKIM not detected" mean?

DKIM adds a digital signature to every email your business sends. Your email provider signs each message with a private key, and publishes the matching public key in your DNS so receiving servers can check the signature.

That public key lives at a name made of a selector plus ._domainkey, such as google._domainkey.yourbusiness.com. Selectors can't be listed from outside, so we try ten common ones: google, selector1, selector2, k1, default, s1, s2, dkim, mail and zoho. If none of them has a key, we show "Not detected."

Why might DKIM be on even though we didn't find it?

Plenty of providers use selectors outside that list. Marketing and transactional services often use their own, and Zoho lets each business pick a name. A domain set up years ago may also use a custom selector.

So treat this result as a question, not a failure. It doesn't lower your score.

How do I check whether DKIM is on?

You have two ways to check:

1. In your email admin console, open the DKIM or email authentication page. Google Workspace shows "Authenticating email with DKIM" when it's on. Microsoft 365 and Zoho show whether signing is enabled for each domain.
2. Send an email from your business address to a personal Gmail or Outlook account, then open the full headers. In Gmail, click the three-dot menu and choose Show original. Look for dkim=pass in the Authentication-Results line, and note the s= value in the DKIM-Signature line. That's your selector.

If you see dkim=pass with your own domain after d=, DKIM is working and you can leave this finding as it is.

Check SPF, DMARC and DKIM together

Run a free scan to see how your email protection and website settings look in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I turn on DKIM?

DKIM is always switched on inside your email provider, which then gives you a DNS record to add. Pick your provider below.

How does DKIM work with SPF and DMARC?

DMARC passes when either SPF or DKIM passes and matches your domain. SPF checks which server sent the message, and it often fails when an email is forwarded, because the forwarding server isn't on your list. A DKIM signature stays attached to the message, so it usually survives forwarding.

That makes DKIM especially useful once you move your DMARC policy to quarantine or reject. Our guide to SPF, DKIM and DMARC explains how the three fit together.

How do I check that it worked?

1. Wait for the DNS record to publish. Some records show up within minutes, and Google says it can take up to 48 hours.
2. Send a test email to a personal account and check the headers for dkim=pass with your domain.
3. Re-run your scan. If your provider uses one of the common selectors, the DKIM result will change to "Found." If not, the header check in step 2 is your confirmation.

What should you do next?

• Confirm DKIM in your email admin console, or send a test email and check the headers.
• Turn on DKIM for every service that sends email as your domain, not just your main mailbox.
• Check your DMARC record with the free DMARC checker, then follow our DMARC policy guide to start blocking fakes.