DKIM Checker

Check a domain's DKIM record for a specific selector.

DKIM selectors aren't discoverable automatically — check your email provider's setup documentation, or a recent email's headers, for the exact selector name.

What is a DKIM checker?

A DKIM checker looks up the public key a domain publishes for DomainKeys Identified Mail. DKIM adds a digital signature to every outgoing email. The receiving server fetches the public key from DNS and uses it to confirm that the message really came from the domain and was not changed on the way. This tool finds that key for a given selector and shows its details.

How the DKIM check works

DKIM keys live at a special DNS name made from a selector and the domain: selector._domainkey.example.com. The selector is a label chosen by your email provider, so one domain can have several keys, one for each service that sends its mail. The tool reads the TXT record at that name and shows:

  • Whether a record was found.
  • The key type, which is RSA unless the record says otherwise.
  • Whether a public key is present, and its size in bits.
  • The service type (s=) and granularity (g=) tags, if set.
  • Whether testing mode (t=y) is switched on.

How to use the DKIM checker

  1. Enter your domain, for example example.com.
  2. Enter the selector your provider uses, such as google for Google Workspace or selector1 for Microsoft 365.
  3. Press Check DKIM.
  4. Confirm the record is found, has a public key and is not in testing mode.

How to find your DKIM selector

Selectors cannot be listed automatically, which is why the tool asks for one. The quickest way to find yours is to open the headers of an email sent from your domain and look for the DKIM-Signature line. The s= value is the selector and d= is the signing domain. Your email provider's setup guide also names the selector it uses.

Selectors used by common providers

  • Google Workspace: google by default.
  • Microsoft 365: selector1 and selector2.
  • Many hosting control panels: default.

Newsletter, helpdesk and invoicing services each use their own selectors, listed on their setup pages. Every service that sends for your domain needs its own DKIM key.

Reading the DKIM results

Public key and key size

A key size of 2048 bits is the current recommendation for RSA keys. Older 1024-bit keys still work but are weaker, so plan to rotate them when your provider allows.

No public key (revoked)

An empty p= value is the standard way to withdraw a key. It is often deliberate after a key has been replaced.

Testing mode

t=y tells receivers the domain is still testing DKIM, so they may not act on failures. Remove it once signing works.

Rotating DKIM keys

Replacing keys from time to time limits the damage if a private key ever leaks. Publish the new key under a new selector, switch signing to it, wait a few days for messages still in transit, then revoke the old key by emptying its p= value.

Common uses

  • Confirming DKIM is published after setting up a new email service.
  • Checking which key size a provider uses.
  • Investigating DKIM failures reported in DMARC reports.

Common problems and fixes

No record found. Check the selector spelling, and make sure the record was added at selector._domainkey under the right domain. Some DNS panels add the domain automatically, which can double it.

The key seems cut off. Long keys are split into several quoted strings inside one TXT record. Paste the value exactly as your provider gives it.

Signing still fails. DKIM must also be switched on in the email service itself, not just published in DNS.

Related tools

Frequently asked questions

What is a DKIM selector?

A selector is a label that tells receivers where to find the right DKIM key, at selector._domainkey.yourdomain. Each sending service usually has its own selector, so one domain can have several keys. You can find yours in the s= value of the DKIM-Signature header of a sent email.

Why can the tool not find my DKIM selector automatically?

DNS does not offer a way to list every name under a domain, and selectors can be any word the provider chooses. Without the exact selector there is no reliable way to find the key. Check an email header or your provider's setup guide for the selector name.

What DKIM key size should I use?

Use 2048-bit RSA keys where your provider supports them. 1024-bit keys still work but offer less protection, and many providers have moved to 2048 bits. Some DNS panels limit the length of TXT records, so the key may need to be split into several quoted strings.

What does "No (revoked)" mean?

The record exists but its p= value is empty. That is the standard way to withdraw a DKIM key, often after the key was replaced by a new one under another selector. Mail signed with a revoked key fails DKIM, so make sure your service is using the current selector.

What does testing mode t=y mean?

The t=y flag tells receiving servers that the domain is still testing DKIM, so they may treat failures more leniently. It is useful during setup. Once you have confirmed messages pass DKIM, remove the flag so that receivers apply DKIM results normally.

Do I need both DKIM and SPF?

Yes, ideally. SPF checks the server that sent the message, while DKIM checks a signature that stays with the message, even through some forwarding. DMARC passes when either one passes and aligns with the visible From domain, so having both makes delivery more reliable.

Why does DKIM fail when the record is correct?

The message may have been signed with a different selector or key, signing may be off in the email service, or the message may have been changed after signing, for example by a mailing list adding a footer. Check the DKIM-Signature and authentication result headers of a failing message.