Back to Tools
📧 Free Tool

DKIM Record Checker

Look up DKIM public keys for a domain, including the common selectors Google, Microsoft, and most ESPs use.

Host becomes selector._domainkey.domain. Leave blank and auto-detect will scan common names.

What this DKIM checker actually looks at

DKIM is the signature, not the allow-list. SPF says which servers may send. DKIM says this message was signed with a key that belongs to the domain, and the body was not rewritten on the way. You need both, then DMARC to tie them to the From address.

The public key lives at selector._domainkey.yourdomain.com. The selector is not universal. Google uses google. Microsoft uses selector1 and selector2, often as CNAMEs. This checker follows CNAMEs, which is why Microsoft records still show up.

What valid means here

A record is valid when p= holds a parseable key. Empty p= is a revocation, not a missing record. 1024-bit RSA still parses and still gets a warning. Signing is not tested. For that you need a real message and an Authentication-Results header.

Auto-detect is a shortlist, not a zone walk

DNS has no “list every DKIM selector” query. The tool checks a fixed list of names ESPs actually use. If your provider picked krs or a date stamp, it may be on the list. If they picked something weird, type it.

The rest of the authentication stack is in the SPF, DKIM, and DMARC guide, and you can confirm SPF on the same domain with the SPF checker.

SPF Record Checker

Look up the live SPF TXT and see lookups, policy, and syntax.

Check SPF →

DMARC Record Checker

Look up _dmarc, read the policy, and see if you are only monitoring.

Check DMARC →

DKIM Checker FAQ

What is a DKIM record?

DKIM (DomainKeys Identified Mail) is a DNS TXT record that holds the public key used to verify a signature on the email. The sending server signs with a private key. Receivers look up selector._domainkey.yourdomain.com and check the signature. If it matches, the message was not altered in transit.

How do I find my DKIM selector?

Your ESP tells you. Google Workspace uses google. Microsoft 365 uses selector1 and selector2. SendGrid often uses s1/s2. You can also open a sent message, show original, and read s= in the DKIM-Signature header. Auto-detect on this page scans the common ones.

Why is a 2048-bit key better than 1024?

1024-bit RSA is still accepted by some receivers and is considered weak. 2048-bit is the current default for Google, Microsoft, and most ESPs. If the checker flags 1024, rotate the key at the provider rather than editing DNS by hand.

Can I have more than one DKIM record?

Yes. Each selector is a different hostname, so Google and Klaviyo can coexist. That is the opposite of SPF, where two TXT records on the same name is a permerror.

What does an empty p= tag mean?

The selector has been revoked. Receivers will not verify signatures that point at it. This is normal during key rotation: publish the new selector first, switch signing, then empty the old p= before deleting the record.

Does a valid DKIM record mean my mail is signed?

No. It means a public key is published. Signing happens on the sending server. Check a real message header for dkim=pass. DNS can be perfect while the ESP is still signing with a different selector.

Want the rest of the setup checked?

A published key is one piece. A free audit covers authentication, list quality, and the sending habits that actually move inbox placement.

Get Your Free Audit →