Check a DKIM key in DNS

Why a signature fails

Each DKIM signature names a selector, the s= value. The mailbox provider fetches the key from <selector>._domainkey.example.com and checks the signature with it.

The check fails when that key is missing, has changed, or does not match the key the service signs with. A service that rotated its key looks exactly like this until the new key is in DNS.

1. On Mailmoni's DNS tab, find the selector in the DKIM table. It shows whether the key was found.
2. In the service, open its DKIM settings and compare the record it shows now with the one in DNS.
3. If they differ, publish the service's current value. If the service gives a CNAME record, remove any TXT record at the same name, because a CNAME cannot share its name with other records.
4. If the record contains t=y, the key is in test mode, and a mailbox provider may treat mail signed with it like unsigned mail. Remove t=y when you finish testing.

A record with an empty p= value means the key was revoked. Publish the service's current key in its place.

Check it worked

Press Check now on Mailmoni's DNS tab. The selector's row in the DKIM table shows "Key found". Reports from the next 24 to 48 hours show whether DKIM passes with this selector.