What it reads
The common DKIM selector names in DNS. On Microsoft 365 the names are known, so a miss is a real fail. Elsewhere a miss is reported as information.
Check 3 of 54 · Email authentication
DKIM presence, explained.
Looks for your signing key where it is usually published, and says "could not confirm" rather than "missing" when it cannot be sure.
Engine 1.57.0, read 25 October 2026
Free checkScoredReliability: Definitive
Can someone send email as you?
What the check does, and where it stops.
Why it matters
DKIM is the tamper-proof signature on your email. Without it, forwarded mail fails DMARC and your policy can never safely reach reject.
What a failure looks like
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Where its limits are
A custom selector name cannot be guessed from outside, so we say so instead of failing you. On the full scan of a domain whose DMARC reports come to us, the selectors seen signing in them are looked up too.
ReliabilityDefinitive: reads a published value
Check 3 is one of 16 in Email authentication. See it in its row on the scanner page, beside the rest of Email authentication.
Run this check on any domain. Free, with no account.
The DKIM checker runs it on its own. It reads the public keys that prove your email was signed by you, on the common selectors or your own.
See how your domain does.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.