Detect Unauthorized DKIM Key Usage

Why Unauthorized DKIM Key Usage Is a Serious Threat to Email Deliverability

You send an email. It arrives. It looks legitimate. But it wasn’t from you. Your domain’s DKIM signature is valid. The message passed all technical checks. That’s the danger: forged emails with your domain’s valid DKIM signature can slip through undetected.

DKIM signs every email from your domain, proving it wasn’t altered in transit. But if an attacker gains access to your DKIM private key—through a misconfigured server, leaked credentials, or a compromised third party—they can sign emails using your domain as if they were you. That’s not a hypothetical risk. It’s how brand impersonation happens at scale.

Public key lookup is the only way to confirm the sender actually owns the key pair used to sign your domain’s emails. Without it, you’re blind to unauthorized usage. One compromised signature can poison sender reputation, trigger spam filters, and lead to domain blacklisting—even if you never sent that message.

Key takeaways

DKIM signatures are only as trustworthy as the private key they’re based on—unauthorized key usage invalidates that trust.
Public key lookup allows you to verify which keys are legitimately signing emails on your domain, helping detect compromise early.
Even a single forged email with a valid DKIM signature can trigger deliverability issues, reputation damage, and blacklisting.

How Public Key Lookup Works: The Technical Foundation of DKIM Verification

DKIM verification starts with a public key lookup: when an email arrives, the receiving server retrieves the sender’s public key from a DNS TXT record using the selector name (like default._domainkey.example.com). If the key doesn’t match the signature, the email fails authentication—only if the recipient checks, which most do. This process is fundamental to detecting unauthorized DKIM key usage, because the public key must match the one used to sign the message.

Decoding the DKIM DNS Record

Each DKIM signature includes a selector, a label that points to a specific public key in DNS. The record is published under a subdomain like selector._domainkey.example.com. This structure lets domains host multiple keys—say, for different departments or sending systems—without conflict. The TXT record contains a u= tag (the domain owner) and the actual public key in base64-encoded format.

When an email arrives, the receiving server performs a DNS lookup using the selector and domain from the DKIM-Signature header. If the public key exists and matches the signature, the message is authenticated. If the key is missing, malformed, or doesn’t verify the signature, it fails. This step is non-negotiable for trust: if the key can’t be validated, the email is treated as potentially forged or misconfigured.

Why Public Key Lookup Prevents Unauthorized Use

Unauthorized DKIM key usage happens when someone signs emails with a key that doesn't belong to the domain. This is impossible without access to the private key—but if a public key is published under a domain, anyone can detect mismatches. A valid DKIM signature must align with the key published in DNS.

Let’s say a hacker signs an email with a key not listed in the domain’s TXT record. Even if the email reaches the inbox, the receiving server will verify the signature against the public key and find a mismatch. That failure triggers a rejection or spam filter marking. This is how public key lookup acts as a guardrail: it ties authenticity to public validation.

According to RFC 6376, which defines DKIM, the public key must be accessible through DNS. The mechanism is designed to make forgery detectable. Tools like RFC 6376 (the DKIM standard) confirm that public key retrieval is a required step in authentication.

You can test this process live using our inbox placement tester or verify your domain’s DKIM alignment across multiple email clients. For developers and teams managing bulk sends, our real-time verification API includes DKIM validation as part of its checks, helping you identify misconfigurations before they impact deliverability.

How to Detect Unauthorized DKIM Key Usage Using Public Key Lookup

You can detect unauthorized DKIM key usage by regularly querying your domain’s DNS records to retrieve the current DKIM public key, then comparing it against known, authorized keys used by your sending systems. A mismatch—such as a key not tied to your ESP, internal mail server, or approved partner—signals potential compromise or abuse. Automated monitoring over time catches unexpected changes, which are common signs of key theft or spoofing, helping prevent deliverability loss and brand impersonation.

Perform a Public Key Lookup

Use a DNS query tool like dig or nslookup to retrieve your DKIM public key from DNS: run dig TXT _domainkey.yourdomain.com (replace with your actual domain). This fetches the DKIM record published by your domain.
Examine the value of the TXT record. It contains the public key in a format like v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC.... The p= field holds the actual key material.
Compare this key with your authorized list—keys used by your email service provider (ESP), marketing platform, or internal mail server. You should only see keys you’ve explicitly configured.

Monitor for Unexpected Changes Over Time

DKIM keys should remain stable unless you intentionally rotate them. An unexpected change in the public key—especially one not documented in your internal records—suggests unauthorized access. Malicious actors may replace your key to intercept or spoof your emails.

Set up automated checks using scripts or third-party tools that validate this key daily or weekly. Services like Spamhaus and RFC 6376 outline best practices for DKIM validation and integrity. These systems confirm that email messages are signed by the rightful sender.

Regular audits help detect misuse early. Once a compromised key is detected, you can revoke it, reissue a new one, and block malicious domains before they cause widespread deliverability issues or damage your brand.

For teams managing large sending volumes, combining public key lookup with real-time email verification tools helps surface suspicious patterns. MailTester’s inbox placement testing verifies how your messages appear in real inboxes, including whether they pass DKIM checks. Use the bulk list verification feature to assess your sender reputation and detect anomalies in your email infrastructure.

Common Signs of Unauthorized DKIM Key Usage

If a DKIM signature validates successfully but the domain doesn’t match your sending infrastructure, or if you see multiple DKIM selectors with unexplained keys, you’re likely dealing with unauthorized use. A sudden volume of DKIM-signed emails from unfamiliar IPs or domains with poor reputations is another red flag. Regular public key lookups can help catch these anomalies early.

Specific Indicators to Monitor

DKIM signatures that verify correctly but originate from a domain not part of your official mailing domains — this means someone is signing emails on your behalf using your public key.
Multiple DKIM selectors (like mail1._domainkey, mail2._domainkey) in DNS with keys you don’t recognize or can’t explain — each selector should correspond to a known sending server or system.
Keeper keys associated with domains that have low reputation scores or appear on spam lists — check reputations via Spamhaus or MxToolbox to validate.
Unexpected spikes in DKIM-valid emails coming from new or unknown IPs or servers — this often points to compromised systems or spoofed configurations.
DKIM signatures using outdated or invalid public keys that still pass validation due to misconfigured DNS records or legacy keys still in use.

Why This Matters

Unauthorized DKIM usage undermines your sender reputation and increases the risk of being flagged by filters. Even if the signature verifies, it doesn't prove legitimacy — just that the key belongs to the domain. Attackers exploit trusted domains this way, bypassing basic checks. Let’s say your brand’s domain is used in a scam campaign: even if you didn’t send it, email providers may associate your domain with spam, hurting deliverability.

Detecting misuse early reduces risk. You can use automated checks via public key lookup during email verification. Tools like MailTester’s verification API or bulk verification can flag suspicious DKIM records during list hygiene. The key is consistent monitoring — not just once, but as part of ongoing email security.

A well-configured DKIM policy should only allow known, verified keys. If a selector or key doesn’t align with your known sending IPs or infrastructure, it should raise a red flag. Remember: DKIM is a signature, not a guarantee. Always validate context.

Why Manual DNS Lookup Isn't Enough for Large-Scale Email Programs

You can’t reliably detect unauthorized DKIM key usage by checking DNS records manually when managing thousands of domains, multiple senders, or frequent key rotations. The process is too slow, too error-prone, and misses real-time threats. Automation is not optional—it’s essential.

Scalability Breaks Down at Scale

Let’s be honest: manually querying DNS for every domain in a large list is a recipe for inconsistency. Each query needs to be correct—wrong syntax, missing labels, or misread selectors lead to false negatives. With dozens of senders and regional infrastructures, you might have 50+ unique DKIM selectors to monitor. Tracking them all by hand? You’ll miss changes, forget updates, and risk missing a breach entirely.

And it’s not just complexity—it’s timing. During infrastructure migrations or routine key rotations, DKIM keys change. A new key might be published, but the old one remains active for a few hours. That window is where attackers can exploit outdated records, especially if they’re still using old key signatures to impersonate your domain. Manual checks happen at intervals—hours, even days—leaving gaps that attackers can exploit.

Timeliness Matters More Than You Think

DNS propagation delays and caching mean that key changes don’t take effect instantly. Some systems retain old records for up to 48 hours. If you’re relying on periodic manual checks, you’re already behind. Unauthorized keys can be used to send spam or phishing campaigns with your domain’s reputation—before you even know the change happened.

That’s why consistent, automated verification is standard practice in enterprise email operations. Tools that check DNS records in real time and validate DKIM selectors per domain, sender, and time frame can catch discrepancies immediately. This includes validating that the public key matches what’s in the DNS, that it hasn’t been replaced by an unknown key, and that no third-party is using your signing infrastructure without authorization.

For teams managing complex mailing ecosystems, manual checks simply don’t scale. The risk of delay or oversight is too high. Instead, use a system that automates verification across all domains and sends—ideally one that integrates with your existing workflow. MailTester’s bulk verification checks DKIM, MX, syntax, and deliverability in one go—no need to dig into DNS records manually. With real-time results and a 98.9% accuracy rate, it’s built for teams who need to act fast.

For developers, the verification API supports real-time integration into onboarding or sending workflows. It validates DKIM configuration at scale without relying on periodic queries. The goal isn’t just to check a key—it’s to ensure that only authorized keys are ever used, and that changes are verified before they’re sent. That’s the only way to maintain a clean sender reputation and inbox placement.

How MailTester Detects Unauthorized DKIM Keys in Real Time

When you validate an email, MailTester checks the domain’s current DKIM public key via real-time DNS lookup. It compares that key against your known, authorized senders. If the key doesn’t match or verification fails, the address is flagged as risky or invalid—catching spoofing attempts at scale, before they harm your sender reputation. This process runs per-email with no delay.

Step-by-Step: How It Works

Fetch the current DKIM record from DNS when verifying any email address. This ensures you’re working with the domain’s live configuration, not outdated or cached data.
Extract the public key from the DKIM signature's selector and domain. This key must be valid and aligned with the sending domain’s published record.
Compare against your authorized sender list. MailTester maintains a baseline of known, legitimate DKIM keys from your approved senders—verified via your past campaigns or domain records.
Flag mismatches or failures. If the key doesn’t match or signature validation fails, the result is marked as risky or invalid, even if the address technically exists.
Scale across thousands of emails without latency. Each verification includes full DNS resolution and signature check—no compromises on speed or accuracy.

Why This Matters for Security and Deliverability

DKIM is meant to confirm email origin. But if an attacker uses a stolen key or a domain with weak controls, your emails can get flagged as fraud. Malicious actors often reuse old keys or forge signatures—this detection catches that.

The 5 steps described in “Step-by-Step: How It Works”, in order.

According to RFC 6376, DKIM signatures must be validated using the public key published in DNS [RFC 6376]. MailTester enforces that rule in real time, not as a post-hoc check.

Let’s say you’re sending a campaign and your list includes a compromised address. If the DKIM key doesn’t match your approved set, MailTester flags it. That prevents your domain from being used in spoofing campaigns, which can lead to inbox placement drops or blacklisting.

Use MailTester’s bulk verification to clean up your list before major sends, or integrate the real-time API into your signup flow to stop risky email abuse upstream.

How to Use MailTester’s API and Bulk Verification to Audit Your DKIM Keys

You can detect unauthorized DKIM key usage by uploading your mailing list or integrating with your CRM or ESP via MailTester’s API. The tool checks each email’s domain against its public DNS records, confirming whether the DKIM signature matches the published key. If a key differs from expected standards—indicating rotation, misconfiguration, or misuse—it flags the address as 'risky'. This enables you to identify compromised or impersonated domains before they send, reducing phishing risk and sender reputation damage.

Upload your list or connect via API
Start by uploading your email list to MailTester’s bulk verification tool or integrate directly with your ESP, CRM, or marketing platform using the real-time verification API. This gives MailTester full visibility into your outgoing email traffic.
Run a full deliverability and DKIM scan
Once data is ingested, the system performs a diagnostic scan covering SMTP, MX, SPF, DKIM, and reputation signals. For DKIM specifically, it retrieves the domain’s public key from DNS and cross-checks it with the key used in the email’s header signature. This is how you catch mismatches due to key rotation, misconfiguration, or impersonation.
Review DKIM verification results by domain
MailTester returns a detailed verdict for each email, including whether the DKIM key matches, is missing, or is inconsistent. Look for domains where the signature key doesn’t align with the published record—this is a signal of potential misuse. The tool tracks not only invalid keys but also unexpected changes, such as a sudden shift from one key to another without known rollout.
Filter by 'risky' verdicts and investigate
Use the dashboard filters to isolate emails marked as 'risky'. These results often indicate domains with non-standard DKIM keys, rotated keys tied to untrusted sources, or keys used across domains not authorized by the owner. Such anomalies commonly appear in phishing campaigns, credential harvesting, or brokered email lists.
Take corrective action
For domains flagged as risky, investigate whether the key was updated intentionally. If not, revoke access to unapproved senders, reset the key, and ensure your DNS records reflect only approved configurations. This prevents attackers from exploiting your domain’s trust.

Why this matters

A mismatched DKIM key can break authentication and trigger spam filters, even if the message is legitimate. According to RFC 6376, DKIM verification is only valid when the public key in DNS aligns with the signature. Unauthorized key usage often precedes domain takeover or spoofing.

MailTester’s approach ensures you’re not relying on guesswork. Instead, you audit what’s actually in the mail flow—down to the key level—using real DNS lookups and standardized checks. By integrating this into your sending workflow, you maintain control over your domain’s reputation and protect your audience.

What the 'Risky' Verdict Means in MailTester’s Email Verification

When MailTester returns a 'risky' verdict, it flags potential issues in email infrastructure—most notably, unexpected changes to a domain’s DKIM public key or signs of unauthorized key usage. This typically means the domain’s advertised public key doesn’t match the one currently active in DNS, or a legitimate address is being sent from a system using a key not authorized by the domain. Let’s unpack what this means in practice.

Detecting Unauthorized DKIM Key Usage

Late-stage email verification, like the kind MailTester performs, checks DNS records—including DKIM public keys—against actual SMTP behavior. If the key in DNS doesn’t align with the one used to sign recent messages, the system flags it as risky. This mismatch can signal compromise, misconfiguration, or misuse by third parties.

For example, if a domain’s public DKIM key is published in DNS but incoming mail from that domain uses a different, valid signature, it could mean someone has sidestepped your published key. This isn’t normal behavior. It’s a red flag that someone might be impersonating your brand through DKIM, even if the email is technically valid.

DKIM relies on public-key cryptography, where the private key signs messages, and the public key (published in DNS) verifies them. If the public key changes unexpectedly, and you didn’t initiate the change, it suggests either a configuration error or a takeover. This is precisely what MailTester’s real-time verification picks up.

How to Respond to a 'Risky' Result

When you see a 'risky' verdict, don’t dismiss it as noise. Use it as a signal to audit your email-sending infrastructure. Check your DNS records via tools like MXToolbox or RFC 6376 to verify the DKIM record matches your current setup.

If you’ve confirmed no changes were made, investigate whether third-party tools or services—like a marketing platform or an email relay—are signing emails with a non-standard or outdated key. In some cases, a service may be using an old private key even after the domain’s public key was updated.

You can test this further using MailTester’s inbox placement tool to simulate message delivery and see how receivers validate DKIM. This helps confirm whether a key mismatch is breaking deliverability or triggering filtering.

If you're processing large volumes, integrate MailTester’s real-time verification API or use bulk verification to scan entire lists for risky addresses before sending.

Don’t ignore 'risky' results—they’re not false positives. They’re early warnings of potential breach, misconfiguration, or abuse. Address them with the same urgency as a blocklist alert.

How to Respond When Unauthorized DKIM Key Usage Is Detected

If you detect unauthorized DKIM key usage, act fast: review all DNS selectors for unexpected entries, revoke unapproved keys immediately, rotate keys only after confirming the new configuration works, validate that authorized services like SendGrid or HubSpot are using the correct keys, and test inbox placement to ensure deliverability isn’t harmed. This sequence minimizes exposure and prevents ongoing spoofing.

Immediate Actions to Take

Check your DNS records for any DKIM selectors you don’t recognize — especially those with strange or unrelated names like auto.2024 or backup._domainkey. Unauthorized entries often appear as anomalies in your known setup.
Revoke any DKIM keys not tied to your confirmed sending infrastructure. This includes keys used by third-party tools you no longer use or internal systems you didn’t deploy.
Do not rotate keys until you’ve validated the new key is correctly published in DNS and properly signed by your sending systems. Premature rotation breaks email flows and causes bounces.

Verification and Validation

Confirm that all authorized sending platforms — such as SendGrid, HubSpot, or Klaviyo — are now using the updated, approved DKIM keys. A misconfigured key can bypass your change and cause continued issues.
Use MailTester’s inbox-placement testing to validate that email delivery improves after remediation. This tests real-world deliverability across major providers like Gmail, Outlook, and Apple Mail. Test your messages in live inboxes before sending to your full list.
Monitor authentication logs over the next 48 hours. If unauthorized keys reappear in DNS, the underlying system may still be compromised.

DKIM is a key line of defense — but only if you own and control every key in your DNS. The DKIM specification defines how to verify signatures, but it doesn’t prevent misuse. That’s your responsibility. Regularly audit your DNS records and treat any unexpected DKIM selector as a red flag.

Even a single unauthorized DKIM key can be exploited for phishing or spoofing. Immediate detection and corrective action are the difference between a minor incident and a full-blown reputation hit.

Use MailTester’s real-time verification API to validate sender configurations at scale, or verify your entire list to spot anomalies before they impact engagement. Keys should be as tightly controlled as passwords — not just trusted, but actively managed.

The Bottom Line: Public Key Lookup Is Essential for Trust in Email

DKIM validity hinges on a single, verifiable fact: the public key must match the signature and be used only by authorized senders. A mismatch or unauthorized use undermines every trust signal in the email chain.

Without periodic public key lookup, compromised keys go undetected until they cause delivery failures or reputation damage. Automated validation — integrated directly into email verification workflows — ensures you catch anomalies in real time, even across millions of addresses.

Regularly verifying DKIM alignment protects domain integrity, reduces bounce rates from invalid or spoofed messages, and strengthens sender reputation. This consistency directly improves inbox placement across major providers.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can DKIM be forged even if the public key is correct?

No — if the public key matches, the signature is mathematically valid. But if the private key is stolen, an attacker can forge emails signed with that key. Public key lookup detects this only if the key is not authorized.

How often should I check DKIM public keys?

At least weekly for high-volume senders. Automated verification tools like MailTester enable daily checks at scale.

What happens if my DKIM key is rotated unexpectedly?

It can trigger false positives in deliverability checks. Ensure key rotations are intentional and documented, and update your verification tool’s trusted key list accordingly.

Can a catch-all address use DKIM?

Yes — catch-all domains can publish DKIM keys. But if an email sent to a non-existent address fails signature verification, it may point to a misconfigured or unauthorized sender.

Does MailTester flag emails with valid DKIM but spoofed content?

No — DKIM verifies message integrity, not sender identity. Use DMARC policies to reject unapproved DKIM signatures and prevent spoofing.

How accurate is MailTester’s DKIM verification?

MailTester’s overall accuracy is 98.9%. This includes real-time DNS checks and behavioral analysis to identify risks like unauthorized key usage.

Can MailTester detect DMARC failures?

Yes — it checks DMARC alignment during the verification process, identifying emails where SPF and DKIM don’t match the From domain.

Is public key lookup part of a larger deliverability check?

Yes — MailTester includes DKIM, SPF, DMARC, bounce analysis, and inbox placement testing as part of a full deliverability assessment.

Do I need to pay to verify DKIM keys?

No — you get 100 free verifications to start. Purchased credits never expire, so you can verify DKIM keys as needed without time pressure.

Can public key lookup prevent spam filters from blocking legitimate emails?

Not directly — but by ensuring DKIM keys are authorized and consistent, you reduce flagging signals that trigger spam filters.