DKIM monitoring: watch selectors before the seal breaks
DKIM monitoring is how you notice a signing selector drifted—deleted after a zone rebuild, rotated without publishing the new TXT, or never published for a new ESP—before inbox providers fail the seal. CrowWake’s check is a public DNS read of selector._domainkey, not a live SMTP signature test.
What DKIM monitoring means here
Operators searching for DKIM monitoring usually want an early rooster: are the public keys for default, google, selector1/selector2 (and any you configure) still published? CrowWake answers with live TXT lookups at selector._domainkey, flags missing keys as fail, and lists which common selectors resolved. It sits beside SPF, DMARC, and MX so “the seal vanished” shows up in the same flock as “the guest list broke.”
What CrowWake checks
We query common DKIM selector names at selector._domainkey.yourdomain for a TXT that looks like a DKIM public key (v=DKIM1 or k=rsa). Healthy selector(s) found → ok (summary lists them). None found → fail. Empty or malformed p= values on known selectors → warn. The free DKIM checker uses the same public lookup with no login—the same signal the hourly probe uses. CrowWake does not decrypt or re-verify a live message body in v1.
Monitoring vs “what is DKIM”
The DKIM guide explains wax seals, selectors, and why keys feed DMARC alignment. Monitoring is the repeat job: catch a deleted selector after a panel cleanup, a rotation that retired the old TXT too early, or a new ESP that never published its key. Both use the same free DKIM checker; CrowWake just repeats the pulse every hour. Pair with SPF and DMARC monitoring so alignment senders stay inventoriable before you raise p=.
What “good enough” looks like
At least one live selector for every platform that sends as you. Publish the new selector before retiring the old during rotation. Do not delete a TXT while the provider still signs with that name. Custom selectors you add in CrowWake are watched alongside the common defaults.
Quick triage when DKIM goes yellow or red
1) Re-run the free DKIM checker and read which selectors resolved (or “none”). 2) If missing, open the ESP’s DKIM setup, publish the TXT they give you, then re-check. 3) If you just rotated keys, confirm the new selector is live before removing the old. 4) Confirm SPF still covers that sender and DMARC still has a policy. 5) Add the domain so CrowWake crows on the next drift instead of waiting for a spam spike.
If CrowWake crows
Treat the failing check as source of truth: no selectors vs empty p= vs wrong host name are different jobs. Use the DKIM how-to for paste-ready DNS shape, re-run the free DKIM checker, then keep watching. CrowWake monitors the public key in DNS—it does not turn on signing inside Google Workspace or rewrite your ESP for you.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free DKIM monitoring / selector checker with no login.
Related: what is DKIM, email authentication monitoring, email authentication, SPF monitoring, SPF, and DMARC monitoring.