What DKIM does
DKIM (DomainKeys Identified Mail) signs each email you send with a private key. Receivers check the signature against the public key your domain publishes in DNS, under a name called a selector: selector._domainkey.yourdomain.
A valid signature proves the email was not altered and was sent with your domain's authority. DMARC relies on it.
Finding your selector
Open an email you sent, show its original source, and look for the DKIM-Signature header: the s= tag is the selector. Google Workspace uses google by default; Microsoft 365 uses selector1 and selector2.
No key found? Turn DKIM on in your provider's admin console and publish the record it gives you (Google Workspace: Apps, Gmail, Authenticate email).
Questions
How long should my DKIM key be?
2048 bits is today's recommendation. A 1024-bit key still works but is weaker; shorter keys should be replaced.
Why does the checker find no key?
Either DKIM is not turned on yet, or you sign with a selector outside the usual list: enter yours in the second field.
What does an empty key (p=) mean?
The key was revoked. Email signed with that selector fails DKIM: publish a new key or stop using that selector.
Does DKIM replace SPF?
No, they work together, and DMARC passes when either one passes and matches your domain.
Where Coolie comes in
A domain that passes these checks is the start. Coolie then sends from your own mailboxes and LinkedIn accounts, paced over working hours, with daily caps per account and per action, a pause when someone replies and an unsubscribe line: how Coolie protects deliverability.