Start your 7-day free trial, card not charged until it ends

DKIM monitoring

DKIM monitoring that notices a missing key

DKIM monitoring checks that the public keys your mail is signed with are still published in DNS. TLDTrack looks for DKIM keys at 21 common selectors on every domain once a day, alerts you when a key disappears or a new one appears, and checks the real signature on any message you send to its email test.

Start your free trial See how it works

Card not charged until your trial ends

01 · Steps

How it works

01

Add your domains

TLDTrack reads public DNS. There is nothing to install and it needs no access to your mail server.

02

It finds your keys

Once a day it looks for a DKIM key at 21 selectors the big mail platforms use, including google, selector1 and selector2, k1, s1 and s2. The first check is stored without an alert.

03

It confirms before it alerts

A lookup that fails keeps the last known result, and a change is read again a few seconds later. You only hear about changes that are still there.

04

You hear what changed

The alert names the selector whose key was removed or added. It goes to contacts who chose DNS alerts, to the mobile app, and to Slack, Teams or a webhook if you use them.

02 · Alerts

What it tells you

Removed

A key disappears

Someone tidies DNS, a provider is switched off or a migration drops the record, and mail signed with that selector starts failing DKIM. Losing every key is a critical alert.

Added

A new key appears

A new sending platform has been set up. Worth knowing, so you can check SPF and DMARC cover it too.

Signature

Does real mail pass?

Send a message to a one-time test address. TLDTrack reads the selector from the message itself, so a custom selector is covered, checks the signature again and tells a key mismatch apart from mail that was never signed.

03 · Good to know

What the daily check covers

  • Selectors outside the 21 common ones are only seen by the email test, which reads the selector from a real message.
  • Key length and strength are not checked.
  • The daily check runs for domains with DNS monitoring switched on, on paid plans.
  • The same check alerts when an SPF record is removed or weakened, and when a DMARC record is removed or its policy changes.

04 · Pricing

Simple, transparent pricing

Every paid plan starts with a 7-day free trial. Cancel during the trial and you won't be charged.

Free forever

Free

Monitor one site, free forever

$0/mo

1 website + 4 extra monitors

No credit card needed

  • Uptime checks every 5 minutes
  • Response time tracking
  • Domain expiry alerts
  • SSL certificate expiry alerts
  • Email alerts
Start free

7 days free

Starter

For individuals & small portfolios

$11/mo

Up to 5 websites

250 monitoring credits / month

  • Uptime, SSL, DNS & blacklist
  • Content & visual change monitoring
  • Accessibility (WCAG 2.2) monitoring
  • Email health & renewal alerts
  • PageSpeed & malware scanning
  • Free WordPress plugin
  • WHM & cPanel monitoring
  • Bulk import & export
  • Security, SEO & compliance scans
  • AI integration (Claude & ChatGPT)
Start free trial

Most popular

Pro

For active managers & agencies

$29/mo

Up to 25 websites

1,250 monitoring credits / month

  • Everything in Starter
  • Up to 5 team members
  • Client report builder
  • AI search visibility
  • Priority support
  • Security, SEO & compliance scans
  • AI integration (Claude & ChatGPT)
Start free trial

7 days free

Agency

For large portfolios & teams

$89/mo

Up to 100 websites

5,000 monitoring credits / month

  • Everything in Pro
  • Up to 20 team members
  • Agency CRM & white-label reports
  • Security, SEO & compliance scans
  • Dedicated support
  • AI integration (Claude & ChatGPT)
Start free trial

Bigger than 100 websites? Our Enterprise plan adds unlimited sites, custom data residency, an SLA, dedicated onboarding and custom integrations. Talk to us

*SMS alerts are an optional add-on on paid plans for UK mobile numbers, paid for with prepaid SMS credit packs. Prices exclude any applicable sales tax. Your card won't be charged during a paid-plan trial. Cancel anytime.

05 · Questions

Frequently asked questions

What is a DKIM selector?

The name a sending platform publishes its public key under, at selector._domainkey.yourdomain. Each platform that sends mail for you usually has its own.

How often are DKIM keys checked?

Once a day for each domain, and whenever you run the email health check from the dashboard.

Can I add my own selector?

Not to the daily check. The email test reads the selector from a real message, so a custom selector is checked there.

Will a domain that never had DKIM alert every day?

No. Alerts are for changes. A domain with no key at the common selectors shows as missing in its email health panel, without daily alerts.

Does it check SPF and DMARC too?

Yes. The same daily check alerts when an SPF record is removed or weakened and when a DMARC record is removed or its policy changes.
Mark Grice, founder of TLDTrack

Mark Grice, founder of TLDTrack. Runs FullyCoded, a Cornwall web agency, and built this to keep 500+ client sites in front of him every day.

What happens next

Watch DKIM on every domain

Do it yourself

Start your free trial

Add your domains and the first daily check stores where each key is published. Your card is not charged for 7 days.

Start your free trial

Talk it through

Arrange a call with Mark

If you would rather talk through how this works across every site you look after, we can go through it together.

Book a call

See every check TLDTrack runs