DKIM monitoring

DKIM (DomainKeys Identified Mail) is a cryptographic method for email authentication, playing an essential role in electronic mail.

It is one of the cornerstones on which DMARC is based and it’s therefore important to keep it monitored, ensuring that your domain’s DNS configuration properly includes the DKIM verification records.

DMARCwise helps you monitor DKIM by continuously scanning and analyzing your domain’s DKIM records. It does so by extracting the DKIM selectors from the DMARC reports of your domain and then fetching the corresponding DNS records.

For example, if your domain is example.com and you use a selector named selector1, DMARCwise helps you keep track of the fact that you’re using this selector and that the DNS record at selector1._domainkey.example.com must be present and valid until you use the selector.

DKIM monitoring also works with subdomains: if you’ve added example.com to the dashboard, we’ll also extract selectors for mail.example.com, etc.

The DNS records for DKIM selectors are refreshed every 3 hours. Note that the DKIM monitoring feature was introduced in December 2025, so the system won’t be able to tell you if a DNS record existed before that date.

Browsing selectors

To see the DKIM selectors discovered and analyzed by DMARCwise, head over to the dashboard, choose a domain and select the DKIM tab.

You’ll see two tables:

• Active selectors shows DKIM selectors that were seen in DMARC reports in the last 30 days or are still present in the DNS zone configuration of the domain.
• Inactive selectors shows the rest of the DKIM selectors, i.e. those that haven’t been seen in DMARC reports recently (and therefore likely not used to sign email messages recently) and are not longer present in the DNS zone.

Selectors in each table are grouped by domain name, making it easy to find selectors associated with a specific subdomain.

Selector details

For each selector, the following information are shown:

• The selector name.
• The email volume signed with the selector in the last 30 days (or less depending on your plan retention), according to DMARC reports, broken down by DKIM pass and fail.
• When the selector was last seen in a DMARC report. When a selector last use date is older than 7 days, the date is shown in yellow; when it’s older than 30 days (inactive) it’s shown in gray.
• The status of the DNS record, which can be:
  • Found.
  • Not found: no DKIM record is currently present.
  • DNS error: when a likely temporary issue prevented the DNS query from succeeding.
  • Pending: this is a newly discovered record and we’re still checking it.
• When the DNS record was last seen, or when the last refresh happened if it’s not found.
• Hovering over the DNS record status lets you see the fully qualified domain name that DMARCwise used to fetch the DKIM TXT record: you can quickly copy it to run your own troubleshooting.
• Essential public key properties like the type/algorithm (RSA or ED25519) and the key length in bits (256, 1024, 2048, etc.). If the key could not be interpreted as a valid key you’ll see “Invalid key” instead.