DKIM Checker
Find and validate a domain's DKIM record by selector: tags, key type and size, test mode, or try the common selectors.
Check a DKIM record
The TXT record at selector._domainkey.domain, with the public key loaded and measured.
What the DKIM Checker does
DKIM Checker fetches the TXT record at selector._domainkey.yourdomain, which is where a mail server publishes the public key that receivers use to verify its signatures. It parses every tag in the record (v, k, p, t, s, h and any notes), decodes the key, loads it with OpenSSL to confirm it is a real public key and reports its type and bit length.
A selector is the name your mail provider chose for its key: google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, and so on. If you do not know it, tick the option to try the common ones and the tool checks nine at once. For an exact answer, open a message you sent in its raw form and read the s= tag of the DKIM-Signature header; the Email Header Analyzer does this for you.
Alongside the key size the tool warns about test mode (t=y), a revoked key (empty p=), SHA-1-only keys, keys under 1024 bits that Gmail ignores, and several records on one selector.
Step by step
- 01Enter the domain that appears in the d= tag of your DKIM signature, which is normally your sending domain.
- 02Type the selector, or tick "Try the common selectors" to check default, google, selector1, selector2, k1, mail, dkim, s1 and s2.
- 03Press Check. Each selector is looked up live in the public DNS.
- 04For a found record, read the key size and the warnings; 2048-bit RSA with no test flag is what you want.
Common questions
Most often the selector is different from what you typed, or the record was added at the wrong name (for example selector._domainkey.example.com.example.com because the panel appended the domain). Some providers publish the key as a CNAME to their own DNS; this tool follows CNAMEs, but the CNAME itself must be published. Check the exact host name in the provider's instructions.
Either the DNS record was truncated, in which case the key would usually fail to load entirely, or the provider is still serving the old selector. Rotate to the new selector in the provider's panel and confirm the s= tag in a fresh message matches.
It marks the key as in testing: receivers verify the signature but are asked not to penalise failures. It is useful for the first days of a rollout. Leaving it on indefinitely weakens the protection DKIM gives you, so remove it once signed messages pass.
Yes. SPF breaks when mail is forwarded and only covers the envelope sender, while DKIM survives forwarding and ties the signature to the From domain. DMARC passes if either SPF or DKIM aligns, and for mail sent through third-party tools DKIM is usually the only one that can align.
Keep checking
SPF Checker
Validate a domain's SPF record: mechanisms, the include tree, the 10 DNS lookup limit, +all and syntax mistakes.
Free toolDMARC Checker
Validate a domain's DMARC record: policy, subdomain policy, pct, reporting addresses, alignment and common mistakes.
Free toolEmail Header Analyzer
Paste raw email headers to see the delivery path hop by hop with delays, SPF, DKIM and DMARC results and spoofing warnings.
Free toolDNS Lookup
Look up the A, AAAA, CNAME, MX, NS, TXT, SOA, SRV and CAA records of any domain with their TTLs in one query.
Free toolBlacklist Checker
Check whether an IP or mail server is listed on Spamhaus, SpamCop, Barracuda, SORBS and ten more DNS blacklists.
Want these fixes done for you?
Our team runs the audit, makes the changes and reports the result.