How can you tell if a prior sender used DKIM for an email?

You open an email and wonder: was this really sent from the company it claims to be? You can’t see the sender’s server, but you can check the email’s source. If it has a DKIM signature, that’s a strong signal it was cryptographically verified at send time.

DKIM isn’t a feature the recipient sees directly — it’s invisible by design. But its mark lives in the email headers. If you know how to look, you can tell whether the sender used DKIM just by inspecting the raw source.

Key takeaways

  • A valid DKIM-Signature header in the email source confirms the sender applied DKIM during transmission.
  • DKIM verification is performed by the receiving server using the sender’s public key published in DNS records.
  • Even if a DKIM signature is present but fails validation, it still proves the sender attempted DKIM signing.

What does a DKIM signature header look like?

Look for a header that starts with DKIM-Signature: in the raw email source. It typically contains fields like v=1; a=rsa-sha256; d=example.com; s=selector;, where d= identifies the signing domain and s= specifies the DNS selector used to retrieve the public key. This signature is a cryptographic proof that the email was sent from a domain authorized to do so.

Breaking down the DKIM-Signature fields

The d=example.com part shows which domain signed the message—this is the domain you should verify against DNS records. The s=selector tells you which TXT record to look up in DNS (e.g., selector._domainkey.example.com). Without this, you can’t validate the signature.

The a=rsa-sha256 field indicates the algorithm used. RSA with SHA-256 is standard; it means the sender used a private key to compute a hash of the email’s headers and body, which the receiver checks using the public key retrieved from DNS. If the hash doesn’t match, the signature fails. This process helps prevent spoofing and maintains sender reputation.

How to verify the signature in practice

To validate the signature, you need to fetch the public key from DNS using the domain and selector. Then, use that key to decrypt the signature and recompute the hash. If it matches, the message was likely not altered in transit and came from a legitimate sender.

For more complex scenarios—like checking whether a specific sender used DKIM for past emails or verifying large volumes of messages—automated tools help. MailTester’s real-time API checks if a DKIM record exists and is properly configured, and its bulk verification tool can flag senders with missing or invalid DKIM records across an entire list.

Cryptographic verification is standard in modern email security. The protocol is defined in RFC 6376, the authoritative specification for DKIM. Proper implementation reduces the risk of rejection, especially from receivers like Gmail, Outlook, or corporate systems that use strict alignment checks.

Can you detect DKIM usage without accessing the original email?

You cannot detect DKIM usage from standard email metadata like sender, subject, or date. DKIM signatures are embedded in the email’s raw headers and are only visible when you inspect the full message source. To verify DKIM was used, you must examine the raw message and look for the DomainKey-Signature or DKIM-Signature header fields.

Why standard headers don't show DKIM

Most email clients and dashboards only display high-level fields—like From, To, and Date—omitting the cryptographic details in the raw headers. DKIM doesn't appear in these fields because it's not part of the user-visible content. It’s stored in a separate block that only appears when you view the full message source.

Tools that can analyze DKIM signature presence

MailTester’s real-time verification API allows you to upload or send a message and analyze its raw headers for DKIM signatures. This includes checking whether a DKIM-Signature header exists, and if it’s valid. You can use it to verify if a sender applied DKIM during delivery.

For example, if you're analyzing a bounced message or testing deliverability, the API checks the full message and returns details on DKIM presence, signature validity, and alignment with SPF and DMARC—key for reputation and inbox placement.

While you can’t detect DKIM without the raw message, tools like MailTester automate the inspection process. You don’t need to manually decode MIME or parse base64. The system handles that and returns clear results: DKIM found, DKIM valid, or DKIM missing.

For detailed, automated checking at scale, use our verification API or test your messages with our inbox placement tool. These tools help you catch issues before sending to a list.

DNS-based email standards like DKIM are defined in RFC 6376. You can find the full specification at IETF RFC 6376. This document outlines how DKIM signatures are generated, verified, and embedded in the message headers.

Understanding DKIM usage isn’t just about security—it’s about trust. If a sender uses DKIM but you can’t verify it from the email’s surface, you’re relying on incomplete data. That’s why inspecting raw headers is necessary. Tools like MailTester make this inspection easy and scalable.

How to verify DKIM usage using email headers

You can verify if a DKIM signature was used by checking the raw email headers for a DKIM-Signature: line, confirming it includes valid d= (domain) and s= (selector) tags, then using DNS to fetch the public key from the domain’s TXT record and verifying the cryptographic hash against the email’s content. This is how email receivers confirm the message wasn’t altered in transit.

  1. Copy the full raw email source from your inbox or mail server. This includes all headers and the body. The raw source is essential because DKIM verification only works on the complete, unaltered message.
  2. Look for a line starting with DKIM-Signature: in the headers. If it’s absent, the message was not DKIM-signed, regardless of other authentication mechanisms like SPF or DMARC.
  3. Check that the signature is syntactically complete and contains d= (the domain that signed the message) and s= (the selector used to locate the public key in DNS). Missing or malformed tags mean the signature is invalid.
  4. Use a DNS lookup to retrieve the public key from the domain’s TXT record. The selector from s= in the DKIM-Signature is part of the TXT record name (e.g., s=mail._domainkey.example.com). Tools like DNSDumpster or MXToolbox can help query TXT records.
  5. Verify that the cryptographic hash in the signature matches the one computed from the message body and signed headers. This step requires recomputing the hash using the same algorithm (usually SHA-256) and comparing it to the hash in the signature. A mismatch means the message was altered after signing.

Why this matters

DKIM ensures message integrity. Without a valid signature, even if SPF and DMARC pass, the email may still be rejected or tagged as suspicious. A failed DKIM verification can signal spoofing attempts, relay tampering, or misconfigured mail servers.

MailTester’s inbox placement testing includes DKIM, SPF, and DMARC checks across multiple inboxes. You can test your outbound messages in real-time to catch issues before delivery.

What is the role of SPF, DKIM, and DMARC in email authentication?

You can verify if a DKIM signature was used by checking the email's raw headers for a DKIM-Signature field. If it’s present and valid, the message was signed with DKIM. But for full verification, you must also check SPF and DMARC results — because these three protocols work together to validate sender identity, prevent spoofing, and build trust with receiving mail servers. They don’t operate in isolation.

SPF, DKIM, and DMARC: What each one does

  • SPF (Sender Policy Framework) checks whether the sending IP address is authorized in the domain’s DNS records. If not, the message fails authentication. It doesn’t sign the message — only validates the envelope sender.
  • DKIM (DomainKeys Identified Mail) adds a digital signature to the email headers and body. This signature ensures content integrity: if any part of the message is altered in transit, the signature fails.
  • DMARC (Domain-based Message Authentication, Reporting & Conformance) sets a policy for how receivers should handle emails that fail SPF or DKIM checks — such as rejecting them, quarantining them, or allowing delivery with a warning.

How they work together for better deliverability

SPF and DKIM must both be valid for DMARC to consider a message authentic. If either fails, DMARC applies its policy, which can result in a bounce or inbox placement issue. For example, if a sender uses DKIM but the signing domain doesn’t match the From domain (a common mismatch), DMARC can still mark the message as untrusted.

Together, these protocols reduce the chance of spoofing and improve sender reputation. Reputable email providers like Google, Microsoft, and Yahoo use DMARC enforcement as a key signal in their spam filters. According to RFC 7489, DMARC is an industry-standard approach to email authentication, and widespread adoption has significantly reduced phishing attempts.

Let’s say you’re sending a newsletter and suspect your emails aren't reaching inboxes. Check the raw headers: look for DKIM-Signature, Authentication-Results, and DMARC fields. Valid signatures and alignment with SPF/DKIM are required for high deliverability.

Using real-time tools like MailTester’s verification API or inbox placement tests lets you check these headers at scale, before sending — ensuring your infrastructure meets authentication standards.

Authenticity isn’t just a checkbox. It’s what keeps your messages out of spam folders and into inboxes.

Does a missing DKIM signature mean the email is fake?

Not necessarily. A missing DKIM signature doesn’t automatically mean an email is fake. Legitimate senders may not use DKIM if their email infrastructure doesn’t support it, or if they rely solely on SPF for authentication. However, when DKIM is expected—such as in DMARC policies—it’s a red flag. An absence of DKIM when required increases the chance of a message being flagged as spam or spoofed.

When DKIM matters most

Many domains enforce DMARC policies that require both SPF and DKIM to pass. If either fails, the message may be rejected or marked as suspicious. This is common in organizations with strict email security standards. Without DKIM, even a valid sender’s message can be blocked, especially by aggressive filters used by providers like Gmail or Microsoft.

Let’s say you’re reviewing an email claiming to come from a company you know. It has a valid SPF record but no DKIM signature. That doesn’t prove it’s fake. But it does mean the sender didn’t follow best practices in email authentication—which makes it more vulnerable to being flagged. According to the IETF’s RFC 7672, DMARC is designed to enforce alignment between SPF and DKIM; when both aren’t present, the message fails the authentication chain.

Beyond DKIM: other signs to watch

Don’t rely solely on DKIM. Spoofed emails can still pass SPF if they’re sent from a trusted IP, especially if the sender isn’t using DKIM at all. That’s why DMARC is critical—it gives domain owners a way to report failures and protect their brand. You can verify DMARC status via tools like MxToolbox or Spamhaus, which show whether a domain enforces authentication.

For teams that send at scale, catching these gaps early matters. You can test whether a sender’s email is properly authenticated with tools like MailTester’s inbox placement checker, which simulates real delivery conditions and reveals authentication failures. Verify inbox placement before sending, or use the email verification API to catch invalid or risky addresses in real time.

Bottom line: a missing DKIM signature isn’t proof of fraud—but it’s a signal. When paired with poor SPF, unverified domains, or odd sender behavior, it should prompt closer inspection. Always check DMARC records and validate addresses using a trusted service. You don’t need magic—just the right tool.

Can MailTester detect when DKIM was used in an email?

Yes. MailTester’s real-time verification API checks incoming email headers for the presence of a DKIM-Signature field and validates its structure and DNS alignment using public records. This tells you whether the original sender used proper email authentication, which directly impacts your own deliverability trust.

How MailTester checks DKIM signatures

When you test an email with MailTester, the system parses the full email header and looks specifically for the DKIM-Signature header field. If it's present, MailTester verifies the syntax is correct and checks that the DNS records for the signing domain (via the selector and domain in the signature) match the published DKIM public key.

This process follows the standards defined in RFC 6376, the core specification for DKIM. It’s not just about detecting a signature—it’s about confirming it’s valid and aligned with the domain that sent the email.

Why DKIM detection matters for your sending reputation

If a prior sender used DKIM properly, that email has a higher chance of being trusted by inbox providers. You can use this information to assess whether an email address or domain is likely to deliver well to inboxes, especially if you’re doing list hygiene or inbox placement testing.

For example, if you’re validating a list of past customer emails, seeing that DKIM was used suggests the domain likely had authentic sending practices. That reduces the chance of the address being flagged or blocked due to spoofing risks.

Let’s say you’re preparing a re-engagement campaign. You can use MailTester’s bulk verification to check which addresses were sent from domains that used DKIM—or didn’t. Addresses from domains without valid DKIM are more likely to be filtered, especially if they come from known spam-heavy sources.

Even if you’re not sending to the original sender’s domain, knowing whether DKIM was used helps you judge the inbox trust level of the email address. This is part of why inbox placement testing with MailTester’s inbox tester gives you a clearer picture than simple syntax checks alone.

How does DKIM impact sender reputation and inbox placement?

DKIM helps inbox providers like Gmail and Outlook assess whether a message is genuinely from the claimed sender. A valid DKIM signature signals consistent sending behavior and message integrity, reducing the chances of your email being filtered, quarantined, or marked as spam. Without it, your email is more likely to be flagged as suspicious, especially if other authentication signals are weak.

Digital signatures confirm legitimacy

When a sender signs an email with DKIM, they cryptographically verify that the message has not been altered in transit and that it truly came from their domain. This isn’t just a technical formality—it’s a signal of credibility. Providers use DKIM validation as one of many checks when deciding whether to place your email in the inbox, spam folder, or reject it outright.

Messages with missing or failed DKIM checks are not automatically rejected, but they receive a credibility discount. According to industry benchmarks—such as those tracked by the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG)—DKIM failure correlates strongly with poor deliverability. If your sending infrastructure doesn’t validate DKIM properly, even well-written content may not reach inboxes.

How providers use DKIM in scoring

Gmail and Outlook both confirm using DKIM as part of their inbound filtering stack. A successful DKIM match adds a positive signal to your sender reputation. Over time, consistent DKIM validation strengthens that reputation, especially when paired with SPF, DMARC, and low complaint rates.

If your email lacks a DKIM signature, or if the signature fails validation, the provider treats that as a red flag. This is especially true when the domain has inconsistent or unreliable sending patterns. Even one failed DKIM check in a high-volume campaign can hurt your chances of landing in the inbox.

For ongoing sender validation, you can test how your messages are perceived. Run an inbox placement test to see if your emails are being caught by filters. MailTester’s inbox tester gives you a real-world readout from major email services. It’s not a guarantee, but it shows whether DKIM and other signals are meeting provider expectations.

Test your inbox placement now

DKIM isn’t a silver bullet. But without it, you’re asking for trouble. It’s an industry-standard practice for a reason—it’s one of the first things email providers check before deciding whether to trust you. You can’t control every factor in deliverability, but getting DKIM right is within your control.

What to do if DKIM was used by a prior sender but failed validation?

If DKIM validation fails despite a prior sender’s use of it, the issue usually lies in altered content, misconfigured DNS records, or an outdated signing algorithm. Reconstruct the original message, verify the public key in DNS, and test under real delivery conditions to isolate the root cause.

Step-by-step: Diagnose and resolve DKIM validation failures

  1. Reconstruct the message to ensure no headers or body were altered in transit.
    DKIM signatures are fragile: even minor changes to headers or body content invalidate the signature. Use an email analysis tool to extract the original message as delivered, not as modified by a client or intermediary. If the signature fails on the original, the fault isn’t in your configuration.
  2. Check that the domain’s public key is published correctly in DNS.
    Verify the DKIM record exists with the right selector (e.g., default._domainkey.example.com) and that the DKIM=** syntax is intact. A missing or incorrectly formatted record leads to validation failure. Use a tool like MxToolbox to query the DNS record directly.
  3. Validate the signing algorithm used in the original message.
    DKIM supports multiple algorithms, but only a few are accepted by modern mail systems. If the signing server used an obsolete or unsupported algorithm like rsa-sha1, modern receivers may reject it even if the key is valid. Check the z= or a= tag in the signature header. Per RFC 6376, rsa-sha256 is now the standard and widely required.
  4. Test the message under real-world delivery conditions.
    Use tools that simulate real sending environments. MailTester’s inbox placement test checks how your message performs across major email providers—revealing whether DKIM failures lead to inbox placement issues or outright blocks.

Prevent future failures with consistency

Once resolved, ensure all outgoing emails use the same signing domain, selector, and algorithm. Avoid mixing signing configurations across systems. Use MailTester’s real-time verification API to validate new senders before sending, catching DKIM issues early. If you're managing a large list, use the bulk verification tool to audit existing addresses for DKIM readiness.

Why does verifying DKIM help with list hygiene and deliverability?

Verifying DKIM signatures tells you whether a sender used authenticated email, helping you filter out invalid, spoofed, or low-quality messages. This improves list hygiene by identifying domains that lack proper authentication, reducing spam complaints and protecting your sender reputation. When your list only includes emails from senders with consistent DKIM, inbox placement improves across major providers.

Filtering out weak or inconsistent senders

Not all senders use DKIM — and some use it incorrectly or inconsistently. Verifying DKIM lets you identify these weak links. A sender without a valid DKIM signature may be sending unauthenticated emails, which increases the risk of spoofing or spam. By filtering out these addresses, you reduce exposure to domains that lack reliable email practices.

Even when DKIM is present, malformed or mismatched signatures can signal poor setup. These are often from outdated systems, bulk email services with poor configuration, or compromised accounts. Spotting them early prevents you from adding them to your list — a move that can trigger filters or spam reports later.

Protecting your domain’s reputation

Every email you send contributes to your sender reputation. If your list includes addresses from domains that routinely send spoofed or low-quality messages, ISPs may flag your domain as a potential source of abuse — even if your own messages are clean. Validating DKIM across your sender ecosystem helps ensure you’re not associated with problematic senders.

According to the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), authenticated email is a baseline for trusted delivery, and receivers increasingly use DKIM and DMARC failure data to assess sender trustworthiness. Using tools like MailTester to verify DKIM helps you stay aligned with industry standards, meaning you're less likely to end up in spam folders.

You can perform these checks at scale using bulk validation tools. With MailTester’s bulk verification, you can test entire lists for DKIM validity, catch-all status, or risk flags — all within minutes. For real-time checks, the email verification API integrates directly into your workflow, ensuring every new subscriber is verified before email delivery.

How to use MailTester’s API to verify DKIM usage in bulk emails

Integrate MailTester’s real-time verification API directly into your email ingestion pipeline to analyze incoming messages at scale.

Send raw email headers and body to the API to examine the presence and validity of DKIM-Signature headers, including cryptographic proof and alignment checks.

Structured output for actionable insights

The API returns clear, machine-readable results: whether a DKIM signature was present, if it passed validation, and its cryptographic status.

Use this data to tag or filter messages by authentication quality—prioritize those with valid DKIM, flag inconsistent or missing signatures.

Validate real-world performance

Run inbox-placement tests on the same email data to measure delivery success across major providers like Gmail, Outlook, and Apple.

This dual-layer approach confirms not just technical correctness, but actual inbox placement—critical for maintaining sender reputation.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can DKIM be forged?

No, not without the private key. A valid DKIM signature requires access to the domain’s private key, making forgery extremely difficult without compromise.

Does DKIM sign the entire email?

No. DKIM signs only selected header fields and the message body, as specified in the signature’s ‘h’ tag. It does not sign all content.

Can an email pass SPF but fail DKIM?

Yes. SPF validates the sending IP; DKIM validates content integrity. One can pass while the other fails, which can affect DMARC outcome.

Is DKIM required for every email?

No, but it is strongly recommended. Many email providers prioritize messages with valid DKIM signatures for inbox delivery.

How often does DKIM validation fail due to DNS issues?

Commonly. Misconfigured TXT records, incorrect selectors, or expired keys cause validation failures even with correct signing.

Can a message have multiple DKIM signatures?

Yes, but only if signed by different domains. Forwarded emails or BCC recipients may add secondary signatures.

What’s the difference between DKIM and S/MIME?

DKIM secures the message during transit using public-key cryptography. S/MIME encrypts and signs for end-to-end privacy, typically used in enterprise email clients.

Does MailTester support DKIM verification for all domains?

Yes. MailTester checks DKIM headers and validates them against DNS records for any domain, regardless of the sender’s reputation.

Can DKIM help avoid spam filters?

Not alone, but a valid DKIM signature improves signal trust. It reduces the chance of rejection by spam filters focused on authentication integrity.

What happens if DKIM is missing but SPF passes?

DMARC may still fail unless the policy allows for SPF-only alignment. Missing DKIM lowers the overall authentication score.

How does MailTester handle catch-all addresses when checking DKIM?

MailTester identifies catch-all domains and evaluates DKIM presence without sending test messages, reducing false positives.

What does 'risky' mean in MailTester’s verification results?

It indicates a partial failure — such as DKIM present but invalid, or a catch-all domain with no clear validation path.