Security & SEO

    DKIM record check

    Verifies DKIM selector records exist and use ≥1024-bit keys — the invisible half of email deliverability that most teams forget.

    Updated 2026-07-10
    1 min read
    dkim
    email
    deliverability

    Quick answer#

    Add your DKIM selectors in the site editor. Lemwatch checks that each selector._domainkey record resolves and uses a strong key.

    What it checks#

  1. Selector TXT record resolves
  2. Key length (flags <1024-bit as weak)
  3. p= (public key) is not empty (empty means revoked)
  4. v=DKIM1 tag present
  5. Where to find it in Lemwatch#

    Site details → Security → Email auth → Selectors. Add one row per selector (e.g. google, s1).

    How to fix#

  6. Ask your mail provider for their DKIM selector name.
  7. Add the selector in Lemwatch.
  8. Publish the TXT record at <selector>._domainkey.yourdomain.com.
  9. Rotate keys yearly to 2048-bit.
  10. FAQ#

    How many selectors can I add?#

    Up to 5 per site.

    Does Lemwatch verify signatures on real messages?#

    No — record health only. For signature verification use your provider's dashboard.

  11. SPF record check
  12. DMARC record check
  13. DNS MX record check
  14. Was this article helpful?