DKIM Checker
Articles, guides, and in-depth tips for the DKIM Checker — everything you need to get the most out of it.
✦ AI-powered — understands natural language
Multiple DKIM Signatures: Which One Actually Counts?
Where Your DKIM Private Key Lives and How Attackers Steal It — A Security-First Look at DKIM Key Management
DKIM private keys must be accessible to the mail server at send time — unlike HTTPS where hardware security modules can isolate keys. Here's where DKIM private keys actually live (PEM files, config, secrets managers), the four exposure vectors (version control, backups, server decommission, shared hosting), what an attacker can do with a stolen key (DKIM-signed phishing that passes DMARC), and why Ed25519 is replacing RSA for new DKIM deployments.
DKIM Signatures Don't Expire — and That's the Replay Attack Problem
DKIM signatures stay valid indefinitely on unmodified messages — which means an attacker who receives a legitimately signed email can replay it to other recipients and the signature will still verify. Here's how DKIM replay attacks work, why the specification doesn't prevent them, what DMARC aggregate reports reveal about replay patterns, and the countermeasures (signing the To: header, signature expiry x= tag) that limit the attack surface.
DKIM Key Length and Algorithm: Why "Still Validates" Doesn't Mean "Still Recommended"
A DKIM key generated five years ago might still be using RSA-1024 — a length that was acceptable then but has since been "softly" deprecated by major providers, even though signatures using it still technically validate. Here's how to identify your key's algorithm and length from its DNS record, why Ed25519 is the emerging alternative (and why dual-key signing addresses its adoption gap), and why this migration follows the same process as any DKIM key rotation.
DKIM, Mailing Lists, and Forwarding: Why Signatures Break and How ARC Tries to Help
A correctly signed email can fail DKIM verification at the recipient simply because a mailing list added an unsubscribe footer — modifying the signed content. Here's why mailing lists and forwarding break DKIM, how ARC (Authenticated Received Chain) was designed to preserve authentication results through intermediaries, and why SPF and DKIM respond differently to forwarding.
The Complete Email Authentication Audit: How to Check SPF, DKIM, DMARC, PTR, and BIMI
Most organisations have never systematically audited their full email authentication stack. Here's the complete 8-step process: inventorying all sending services, auditing SPF, DKIM, DMARC, PTR, and BIMI, sending a test to verify all pass, and setting up ongoing monitoring.
DKIM Key Rotation, Multiple Selectors, and Debugging Silent Failures
DKIM breaks silently and the symptoms look like spam problems. Here's key rotation without disruption, why DKIM alignment matters for DMARC, multiple selectors for multiple sending sources, and how to debug the most common failure modes.
DKIM Checker — Verify Your Domain's Email Signing Key in DNS
Learn how DKIM works, what a DKIM DNS record contains, how to find your selector, and how to use a free DKIM checker to verify your email signing key is correctly published.
