What is DKIM? Wax seal + free DKIM checker
DKIM is a wax seal for email: your server signs the message; the receiver checks a public key in DNS to prove nobody swapped the contents in transit. A free DKIM checker confirms common selectors still publish v=DKIM1 (or k=rsa) before you rotate keys or chase DMARC alignment.
What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that attaches a digital signature to outbound messages. Receivers look up a public key at selector._domainkey.yourdomain, verify the signature, and decide whether the body and headers were altered in transit. It is the “seal the message” half of email authentication—SPF lists who may send; DMARC decides what to do when either check fails.
The DNS record (selector._domainkey)
Each sending platform publishes a TXT at a named selector—google._domainkey, selector1._domainkey, default._domainkey, and so on—with a public key that looks like v=DKIM1; k=rsa; p=…. The selector name is chosen by the ESP; you paste the host and value they give you. Empty p= (or a wiped TXT) means the seal cannot verify even if the ESP still tries to sign.
How to check DKIM (free DKIM checker)
1) Run the free DKIM checker on the bare domain. 2) Confirm at least one common selector resolves with a DKIM-looking TXT (v=DKIM1 or k=rsa). 3) Read which selectors CrowWake found (google, selector1/selector2, default, Hostinger, Resend, and any you configure). 4) If you just rotated keys, confirm the new selector is live before deleting the old. 5) Pair with SPF and DMARC so alignment senders stay inventoriable. 6) After any zone edit, re-check; _domainkey rows are easy to drop in panel rebuilds.
What CrowWake checks
We query common DKIM selector names (default, google, selector1, selector2, and any you configure) at selector._domainkey.yourdomain. We look for a TXT that looks like a DKIM public key (v=DKIM1 or k=rsa). Healthy selector(s) → ok. None found → fail. Empty or malformed p= on known selectors → warn. The free DKIM checker uses the same public lookup with no login. CrowWake does not decrypt or re-verify a live message body in v1—just whether the public key is still published. For the repeat “watch this hourly” job, see the dedicated DKIM monitoring guide.
DKIM vs DKIM monitoring
This guide is the definition and publish/triage job: what DKIM is, how selectors + public keys work, and how to check DKIM with a free DKIM checker. DKIM monitoring is the hourly rooster—catch a wiped selector, a rotation that retired the old TXT too early, or a new ESP that never published its key. Both use the same free checker; CrowWake just repeats the pulse.
Why it matters
Providers treat signed mail as more trustworthy. DKIM also feeds DMARC: without a valid signature aligned to your domain, DMARC cannot fully protect you from spoofing—even if SPF exists. Agencies lose _domainkey rows during rebuilds and only notice when campaigns hit spam or DMARC alignment collapses.
What “good enough” looks like
At least one live selector for every platform that sends as you. Keys rotate without downtime (publish the new selector before retiring the old). Do not delete a selector while a provider still signs with it. Custom selectors you add in CrowWake are watched alongside the common defaults.
Publish checklist (order matters)
1) Inventory every platform that sends as you. 2) Open each ESP’s DKIM setup and publish the TXT they give you. 3) Run the free DKIM checker and confirm those selectors resolve. 4) Confirm SPF still covers those senders (free SPF checker). 5) Keep or tighten DMARC (free DMARC checker). 6) Add the domain so CrowWake crows if a selector disappears or p= goes empty.
If CrowWake crows
No selectors found → open your mail provider’s DKIM setup and publish the TXT they give you. Empty p= → re-copy the full key from the ESP; a truncated paste fails verification. Mid-rotation → keep the old selector live until the new one resolves. Partial coverage is normal if you only use one ESP—just make sure that ESP’s selector is present. After DNS changes, give caches a few minutes, then re-run the free DKIM checker and confirm CrowWake goes green.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free DKIM / DKIM checker checker with no login.
Deep dive: DKIM monitoring — watch selector._domainkey so a silent wipe or empty public key crows early, with the same free DKIM checker.
The free DKIM checker lists live selectors. Pair with email authentication monitoring, what is email authentication, SPF monitoring, and DMARC monitoring.