Key points at a glance
- DKIM digitally signs every email; the recipient checks the signature with the key from your DNS.
- Every service that sends in your name needs DKIM set up with your own domain.
- Keys with 2048 bits are standard today; anything shorter than 1024 bits is considered insecure.
What DKIM does
With DKIM (DomainKeys Identified Mail, RFC 6376), your mail server signs every outgoing email with a private key. You publish the matching public key in the DNS. The receiving server uses it to check the signature. If it matches, it is clear: the email comes from an authorised server, and the header and content are unchanged.
- SignYour mail server signs the email with the private key.
- SendThe signature travels in the header of the email.
- Fetch keyThe recipient reads the public key from your DNS.
- VerifyIf the signature matches, the email is genuine and unchanged.
Selector and DNS record
The public key sits under a “selector”, for example selector1._domainkey.example.com. This means every service sending in your name can have its own key. Microsoft 365, Google Workspace and most newsletter services provide you with the necessary records; you only need to add them to the DNS and activate them.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
What to watch for
- Key length: RSA keys should be 2048 bits long; anything shorter than 1024 bits is considered insecure (RFC 8301).
- Every sending service needs DKIM with your domain (d=example.com), not the service’s own domain.
- Rotate keys regularly and remove old selectors once a service is no longer used.
Tip
Ask every service that sends in your name – newsletter, CRM, accounting – for DKIM set up with your own domain. Many providers describe this in their help pages.
DKIM and DMARC
Unlike SPF, DKIM usually survives forwarding too. For DMARC, what matters is that the signing domain matches the visible sender address. That makes correctly configured DKIM the most important prerequisite for p=reject.
No safe p=reject without DKIM
SPF often breaks for forwarded emails. If a matching DKIM signature is then missing, p=reject would reject genuine emails too.
How DomainRadar helps
DomainRadar checks the known selectors of your domains, assesses the key length and shows in the DMARC reports which services send without a matching DKIM signature.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.