DKIM Record Checker: Free DKIM Key Lookup & Validator

DKIM Record AUTH
Quick select:
Looking up DKIM selectors…
Your IP:
Your Country:
Selector Provider Key Result

Find the DKIM keys a domain publishes, test your own selector, and check key type, key length and revoked or testing keys.

DKIM (DomainKeys Identified Mail) Overview

What is a DKIM record?

DKIM lets a mail server sign every message it sends with a private key. The matching public key is published in DNS as a TXT record, so any receiving server can check that the message really came from your domain and was not changed on the way.

Where does the DKIM record live?

Unlike SPF, the DKIM key is not published on the domain itself. It sits at a name made of a selector, the fixed label _domainkey and your domain. Each sending service picks its own selector, so a domain often has several DKIM records, one per service.

Example

google._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

How do I find my DKIM selector?

Leave the selector box empty and the checker tries the selectors used by the most common mail services, such as Google Workspace, Microsoft 365, Mailchimp, SendGrid and Amazon SES. If your key is not found, open the headers of an email you sent, find the DKIM-Signature line and copy the value after s=. Enter that in the selector box and check again.

What does the checker look at?

For every key it finds, the checker reads the record and reports the key type and length, whether the key has been revoked (an empty p=), whether the domain is still in testing mode (t=y), and whether the record is published twice. Keys shorter than 2048 bit are flagged so you know when it is time to rotate.

FAQs

A selector is the name that tells receivers where to find the public key. The key lives at selector._domainkey.yourdomain.com, and the selector used for a message is in the s= tag of its DKIM-Signature header.

Selectors are chosen by each mail provider, so they cannot be listed from DNS. The checker tries the selectors most providers use. If yours is different, open the headers of an email you sent, copy the value after s= in the DKIM-Signature line, and enter it in the selector box.

Use 2048 bit RSA keys. 1024 bit keys still work with most receivers but are considered weak, and anything shorter is rejected.

An empty p= means the key has been revoked. Mail still signed with that selector will fail DKIM, so senders should move to a new selector.

Yes. Every sending service usually has its own selector and key, for example one for Google Workspace and one for a newsletter tool. Each selector must have exactly one record.

DKIM Troubleshooting & Practical Fixes

The receiving server looked up selector._domainkey.yourdomain and found nothing. Usually the record was never published, was added at the wrong name, or the DNS host added your domain to the end of the name a second time.

How to fix: Enter the selector from the s= tag above and check that a record comes back. In most DNS panels the host field should be only selector._domainkey, without your domain.

1024 bit RSA keys still work at most receivers but are treated as weak, and some providers are starting to score them lower.

How to fix: Generate a 2048 bit key in your mail provider's admin panel, publish it under a new selector, switch signing to it, and remove the old record a few days later.

A single TXT string can hold only 255 characters, and a 2048 bit key is longer than that. Some DNS panels refuse the value or cut it short.

How to fix: Split the key into several quoted strings inside one record, or use the CNAME option many providers offer so they host the key for you.