DKIM Verification Checklist: Selector, DNS and Signing
A DKIM record in DNS is only one part of the check. The sending service must also sign outgoing messages with the corresponding configuration. Keep publication, activation and received-message verification as three separate milestones.
Identify the service and selector
Make a row for every sending platform: mailbox provider, website delivery service, newsletter and support tool. Record its sending domain and the selector or selectors shown in its current setup instructions. Do not guess a selector from a tutorial for another provider.
DKIM uses a signature on the message and a public key published through DNS. The private signing key stays with the sending system. Your handover document needs ownership and selector details, not private keys. Record who can rotate or replace the configuration.
Compare the exact DNS instructions
Check the complete DNS hostname and required record type. Providers may prescribe TXT publication or CNAME-based delegation; follow that service’s instructions. A DNS interface may automatically append your domain, so compare the resulting fully qualified name instead of relying on what was typed into the form.
Google Workspace’s instructions separate generating a key, publishing it and turning on authentication. That sequence illustrates why a visible DNS value alone is insufficient. Use your provider’s activation check after confirming publication, and capture its result.
| Check | Evidence to record | Next decision |
|---|---|---|
| Sending service | Account, domain and configuration owner | Confirm the service is still in use |
| Selector | Expected selector and complete DNS hostname | Compare instructions with the published name |
| Publication | Record type and public lookup result | Resolve a missing or malformed value |
| Active signing | Recipient header result and signing domain | Verify the system used the expected configuration |
Inspect a real received message
Send an ordinary controlled test from the relevant application to a mailbox you control. Inspect the authentication results at the recipient. Record whether DKIM passed and which signing domain was used. Keep the message identifier and time so support can find the same delivery.
Repeat for other systems; a newsletter platform’s successful test says nothing about WordPress mail. Do not paste full message headers into public comments. They can contain addresses and routing information; use a private support channel with unnecessary personal details removed.
Handle changes without losing the trail
Before rotating keys or switching services, ask the provider how its changeover works and which published records must remain during the transition. Record the old and new selectors, the authorized cutover and a representative test after it. Remove old records only when the responsible administrator confirms they are no longer needed.
If the test does not pass, investigate the named service, selector, DNS publication and signing activation in that order. Avoid making unrelated SPF or MX changes while diagnosing one missing signature. Several simultaneous edits can hide the cause.
Define the completion check
A useful sign-off includes published DNS evidence, an active-service confirmation and received headers from each sending path. If DKIM passes but DMARC fails, investigate whether the authenticated signing domain aligns with the visible From domain; passing one mechanism and passing the domain policy are different observations.
This checklist establishes authentication evidence for the tested message. It does not certify every future message or promise that recipients will place it in the inbox.
Example: DNS exists but the message is unsigned
A hypothetical DNS lookup finds the provider’s DKIM record, but a controlled message has no corresponding signature. Confirm the sending service, active signing configuration and selector used for that attempt. A published key alone does not prove the service signed the message. If the signature is present but verification fails, compare its selector and signing domain with the provider’s exact instructions.
Sources and scope
Official documentation checked October 6, 2026: Google Workspace: Set up DKIM; Gmail sender guidelines. This is HRL’s general operating checklist, not a test of your domain or a guarantee of delivery, recovery or search visibility.