DKIM record check
Verifies DKIM selector records exist and use ≥1024-bit keys — the invisible half of email deliverability that most teams forget.
Quick answer#
Add your DKIM selectors in the site editor. Lemwatch checks that each selector._domainkey record resolves and uses a strong key.
What it checks#
Where to find it in Lemwatch#
Site details → Security → Email auth → Selectors. Add one row per selector (e.g. google, s1).
How to fix#
<selector>._domainkey.yourdomain.com.FAQ#
How many selectors can I add?#
Up to 5 per site.
Does Lemwatch verify signatures on real messages?#
No — record health only. For signature verification use your provider's dashboard.
Related#
Related Articles
SPF record check
Parses your SPF record, counts DNS lookups (10 max), and warns before you hit the RFC 7208 limit that silently breaks deliverability.
DMARC record check
Explains how to read a DMARC record, assess SPF and DKIM alignment, and make a staged policy decision without treating a DNS record as proof of mail delivery.
DNS MX record check
Monitors MX records so a fat-fingered mail edit or expired provider does not silently break customer email.
Certificate chain check
Verifies your TLS cert is served with the full intermediate chain — the #1 cause of "insecure connection" errors on Android and older curl.