FmindSecurity guide
Email signing (DKIM)
DKIM adds a digital signature to your emails so recipients can check that they really come from your business and were not altered. Without it, your emails are more likely to land in spam and DMARC protects your domain less well.
Who can help
Your email administrator
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Use an external message received from this domain to find its signing domain (d=) and selector (s=), then look up that exact DNS name. To check a change, use a message sent after the update took effect, not an older or internal one. Keep message contents private and don’t remove working keys.
dig +time=3 +tries=1 TXT ACTUAL_SELECTOR._domainkey.ACTUAL_SIGNING_DOMAINWhat to do
In your email provider’s admin settings (for example Google Workspace or Microsoft 365), turn on DKIM and publish exactly the DNS record it gives you. The private key stays with your provider; never share it. If this check found no key, your emails may still be signed under a name we did not try.
How to verify the change
Once DKIM is switched on and the DNS change has taken effect, send a new email to an external address you control (not an alias or a colleague). In the received message’s headers, look for dkim=pass and note the d= and s= values in DKIM-Signature: s= is the selector to look up in DNS.
Step-by-step email setup
What this check can establish
We only try a few common selector names. Finding a key does not prove that your emails are signed or accepted, and not finding one does not prove that they aren’t.