DKIM Record Checker

Enter a domain to look up its DKIM public key. If you know the selector, give it; if not, leave it blank and the common selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid and others are tried automatically.

Each key found is validated — algorithm, key type, key length, and whether it has been revoked.

How it works

DKIM adds a cryptographic signature to outgoing mail. The sending server signs each message with a private key; the receiving server fetches the matching public key from your DNS and verifies it. A valid signature proves the message was genuinely authorised by your domain and has not been altered in transit.

The public key lives at {selector}._domainkey.{yourdomain}. The selector is a label chosen by whoever set up signing, which lets one domain publish several keys — one per sending service, and a second key during rotation.

There is no way to discover selectors from DNS. You cannot ask a domain which selectors it uses; you can only ask whether a specific one exists. This is why the tool tries a list of known provider selectors, and why a "not found" result does not prove DKIM is absent — only that none of the selectors we tried is in use. The certain way to find yours is to look at the DKIM-Signature header of a message you sent: the s= tag is the selector.

What matters in the record itself:

• Key length. 1024-bit RSA is still widespread and still accepted, but 2048-bit is the current recommendation. Below 1024 is genuinely weak.
• Revocation. A record with an empty p= tag is a deliberate revocation — the key is published as void. Signatures using it will fail, which is intended after rotation but a problem if unintentional.
• Rotation. Keys should be rotated periodically, which is why publishing two selectors and switching between them is common practice.

DKIM matters more than SPF for one specific reason: it survives forwarding. When a message is forwarded, SPF fails because the relaying server is not in your record — but the DKIM signature still validates. Without DKIM, forwarded mail fails DMARC.

Frequently asked questions