1. Find the signature from your sender

Open the original message and locate DKIM-Signature. A message can have several signatures, so record the signing domain, selector, and the service associated with each one. Do not assume the first signature belongs to your visible From domain.

DKIM-Signature: v=1; a=rsa-sha256;
  d=example.com; s=mail2026; ...

This shortened example deliberately omits the signature and body hash. It shows where the two lookup inputs come from, not a signature that can be validated.

2. Query the exact key location

For that example, the lookup name is mail2026._domainkey.example.com:

dig TXT mail2026._domainkey.example.com

If your provider delegates the key through a CNAME, follow its documented record configuration and inspect the resolved answer. Check whether your DNS interface automatically appends the zone name before entering a hostname; an accidental duplicated suffix is an easy way to publish the right value at the wrong location.

3. Compare DNS with message-level evidence

A key lookup answers “what public key is published here?” Signature verification also needs the signed message bytes and the signature’s parameters. Use the trusted receiving system’s verification result or a suitable message validator rather than treating DNS presence as a pass.

If verification fails, preserve the original message. Changes to signed content along the delivery path may matter. Compare a direct test and the affected route before rotating keys or changing the sending platform.

4. Make key changes with a transition plan

For a rotation, ask the provider how it switches selectors and how long older signatures may remain in transit. Publish the replacement first, verify a fresh message using it, and retire the old selector only after the agreed overlap. Deleting a working key immediately can complicate verification of delayed mail.

Keep the selector, DNS evidence, test timestamp, and receiver result in the change record. None of these require exposing the private key.

Before you move on

  • Signing domain and selector copied from a message.
  • Exact DNS name checked.
  • Key presence distinguished from signature verification.
  • Private key excluded from all evidence.