How to Check a DKIM Record and Fix Common DKIM Errors

DKIM is one of the most important email-authentication mechanisms, but it is also one of the easiest to misconfigure.

A domain may have SPF and DMARC configured correctly and still fail authentication because the DKIM selector is wrong, the public key is missing, or the DNS record was published incorrectly.

Here is a simple way to troubleshoot it.

1. Find Your DKIM Selector

DKIM records are not usually stored directly on the root domain.

They use a selector, such as:

selector1._domainkey.example.com

Common selectors may include:

default
google
selector1
selector2
dkim
mail

Your exact selector depends on the email provider you use.

1. Check the DKIM TXT Record

From the terminal, you can query the record with:

dig TXT selector1._domainkey.example.com

or:

nslookup -type=TXT selector1._domainkey.example.com

A valid result should return a DKIM public key.

1. Common DKIM Problems

The most frequent issues include:

Wrong selector
Missing DNS record
Broken public key
DKIM not enabled in the email provider
Incorrect DNS formatting
Old keys still being used

LeadCanal's DKIM checker specifically looks for missing records, invalid selectors and authentication configuration problems.

1. Use a DKIM Checker

If you do not want to troubleshoot manually, use the LeadCanal DKIM Record Checker.

It can check the DKIM DNS record, validate the selector, display the public key, and help identify configuration issues that may affect deliverability.

1. Generate a New DKIM Record if Needed

If your existing setup is missing or incorrect, LeadCanal also has a DKIM Record Generator for creating a valid DKIM record based on your provider and selector.

Final Takeaway

When DKIM fails, check:

selector → DNS record → public key → provider configuration

Do not assume DKIM is working just because SPF or DMARC exists.

A quick selector lookup can often reveal the problem immediately.