# DKIM: understand the signature on your email

> Find the DKIM signing domain and selector, interpret a reported signature result and check whether it helps your domain pass DMARC.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Reviewed: 2026-11-06.

## A signature belongs to a signing domain

DKIM uses a cryptographic signature to associate a message with a signing domain. A receiver retrieves the corresponding public key from DNS and verifies the signature. The d= value identifies the signing domain; s= identifies the selector used to locate its key.

A message can carry more than one DKIM signature. The presence of a DKIM-Signature header is not itself evidence that verification passed.

## Use the reported result and identity together

In CheckDMARC, compare the DKIM result, signing domain and visible From domain. Paste headers interprets recorded authentication results; it does not independently re-run cryptographic verification. A green result is meaningful only in the context of a receiver you trust.

DKIM fields to keep when investigating
| Field | Why it helps |
| --- | --- |
| DKIM result | Distinguishes a reported pass from fail, missing or an error. |
| Signing domain (d=) | Shows whose domain signed and lets you investigate alignment. |
| Selector (s=) | Helps your provider find the matching DNS key configuration. |
| Original receiver headers | Preserves the context of the verification result. |

- [Read authentication headers](https://checkdmarc.mx/learn/email-authentication-headers)
- [Understand DMARC alignment](https://checkdmarc.mx/learn/dmarc#alignment)

## Check the sending service before replacing keys

For a missing signature, confirm that custom-domain signing is enabled in the service that sent this message. For a failure, check that the selector and DNS key match the provider’s current setup. Message modifications in transit can also invalidate a signature.

Test each sender separately. A passing signature from your mailbox says nothing about a newsletter sent by another platform. Avoid replacing or deleting active keys without checking which systems still use them.

- [Test the sending service](https://checkdmarc.mx/#email-check)
- [See a complete passing sample](https://checkdmarc.mx/sample-result)

## Sources

- [RFC 6376 — DKIM Signatures](https://www.rfc-editor.org/rfc/rfc6376.html)

## Related reading

- [SPF: check which servers can send for your domain](https://checkdmarc.mx/learn/spf/index.md)

- [DMARC: connect authentication to your From domain](https://checkdmarc.mx/learn/dmarc/index.md)

- [SPF and DKIM pass, but DMARC fails. What now?](https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail/index.md)

[Check your email](https://checkdmarc.mx/#email-check)

Web page: https://checkdmarc.mx/learn/dkim