DKIM Record Checker
Enter a domain and the DKIM selector from your email provider. Leave the selector empty to try the most common ones.
Frequently asked questions
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the headers of outgoing email. The matching public key is published in DNS at selector._domainkey.yourdomain.com. Receivers use it to verify that the message was signed by your domain and was not altered in transit.
What is a DKIM selector and how do I find mine?
A selector is a label that lets a domain publish several DKIM keys, for example one per email service. Common ones are google (Google Workspace) and selector1 and selector2 (Microsoft 365). You can find yours in the s= tag of the DKIM-Signature header on an email you sent, or in your email provider's DNS setup instructions.
What key length should I use?
2048-bit RSA is the current recommendation. 1024-bit keys are still accepted by most receivers but are weaker, and anything under 1024 bits is considered insecure. Ed25519 keys are also supported by the standard but not yet by all receivers.
Why does the checker say no record was found when I use DKIM?
The selector is the usual cause, since it must match exactly what your provider gave you. Others: the DNS record was just added and has not propagated yet, or it was entered at the wrong name. Without a selector, this tool tries only the most common ones, so not finding a key never proves a domain has no DKIM.
What does an empty p= value mean?
It means the key has been revoked on purpose. Mail signed with that selector will fail DKIM. Publish a new key under a new selector if you still send with it.
How do SPF, DKIM and DMARC fit together?
SPF checks that the sending server is authorized. DKIM checks that the message is signed by your domain and unchanged. DMARC then requires at least one of them to pass and to match the visible From domain, and tells receivers what to do when they do not.