Testing DKIM Before Go-Live: Pre-Production Checklist

You have generated your DKIM keys, added the DNS record, and configured your mail server. Before you flip the switch and start signing every outgoing email, take thirty minutes to verify everything works. A small mistake caught now saves you from deliverability headaches later.

Browse all Security guides.

Step 1: Verify Your DNS Record Is Live

The most common reason DKIM fails on launch day is that the DNS record has not propagated or contains a typo. Confirm it exists and looks correct before doing anything else.

dig TXT selector._domainkey.yourdomain.com +short

nslookup -type=TXT selector._domainkey.yourdomain.com

Step 2: Use the Testing Flag

DKIM supports a t=y flag in the DNS record that tells receiving servers your key is in testing mode, as defined in RFC 6376 Section 3.6.1. While the flag does not change how signatures are verified, it signals to receivers that failures should not be treated harshly.

Add t=y to your record before launch:

v=DKIM1; k=rsa; t=y; p=MIIBIjAN...

Once you have confirmed everything works, remove the t=y flag so receivers treat your signatures as production-ready.

Step 3: Send Test Emails to Verification Services

Rather than guessing whether your signatures pass, send a test email to a service that analyzes authentication headers for you.

Send at least one test message and confirm you see dkim=pass before moving on.

Step 4: Read the Authentication-Results Header

Every email you receive includes an Authentication-Results header added by the receiving server. Learning to read it takes a minute and saves hours of guessing.

Look for a line like this:

Authentication-Results: mx.google.com;
  dkim=pass header.d=yourdomain.com header.s=selector

Key things to check:

• dkim=pass means the signature was verified successfully.
• header.d= should match your sending domain.
• header.s= should match the selector you configured.

If you see dkim=fail, the header often includes a reason such as "body hash did not verify" or "key not found", which points you to the fix. For a full list of failure types, see common DKIM errors.

Step 5: Check DKIM Alignment for DMARC

DMARC requires that the domain in your DKIM signature (d= tag) aligns with the domain in the From header, as specified in RFC 6376 Section 3.5. Even if DKIM passes, a misaligned domain means DMARC will not count it.

If you plan to enforce DMARC (and you should), verify alignment now rather than discovering the gap after go-live.

Step 6: Test Across Multiple Providers

Do not test with only one mailbox. Different providers handle DKIM in slightly different ways, and a problem that hides in Gmail may surface in Outlook or Yahoo.

Send a test email to each of these and confirm dkim=pass:

• Gmail - Check via "Show original"
• Outlook / Microsoft 365 - Check via "View message source"
• Yahoo Mail - Check via "View raw message"

If DKIM passes at all three, you can be confident your setup is solid.

Common Pre-Launch Mistakes

Before you declare victory, double-check these frequent pitfalls:

• Selector typo in DNS - The hostname must be exactly selector._domainkey, including the underscore and period.
• Key pair mismatch - The private key on your server and the public key in DNS must come from the same generation step.
• Truncated TXT record - Some DNS providers silently cut long records. Verify the full base64 string is present.
• Signing not enabled - You added the DNS record but never turned on signing in your mail server or provider dashboard.
• Testing from the wrong server - Make sure you send test emails from the same server or service that will handle production sending.

Go-Live Checklist

Use this as your final sign-off before removing the t=y flag and going live:

Post-Launch Monitoring

Going live is not the end of the process. Keep an eye on things for the first few weeks:

• Review DMARC aggregate reports for any DKIM failures you did not catch during testing.
• Watch your bounce rate - a sudden spike may point to a signing issue.
• Re-test after any DNS or mail server changes to catch regressions early.
• Plan key rotation - schedule a reminder to rotate your DKIM keys at least once a year.

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures

Take the guesswork out of DKIM. Generate your keys, test before you launch, and go live with confidence.