Skip to main content
Get started

DKIM checker

Look up the DKIM key behind a selector. Don't know yours? The checker tries the selectors of common mail services. Either way you see whether the key is valid and strong enough.

Screenshot of TXT records in the DNSense DNS manager
Free DKIM tool

Check a DKIM record

Guide

How DKIM works and how to find your selector

DKIM (DomainKeys Identified Mail) signs every message you send with a private key. The matching public key is published in DNS, so receivers can check that the message really came from your domain and was not changed on the way. DKIM is one of the two checks behind DMARC, next to SPF.

The public key lives in a TXT record on selector._domainkey.yourdomain.com. The selector is a name your mail provider chooses, so one domain can have several keys at once, one per sending service.

To find your selector, send a mail to yourself and open the original message. In the DKIM-Signature header, the s= tag is the selector and d= is the domain. Common ones are google for Google Workspace and selector1 and selector2 for Microsoft 365.

TagMeaning
v=DKIM1Marks the record as DKIM.
k=rsaThe key type. rsa is the default, ed25519 is also supported.
p=The public key. An empty value means the key is revoked.
t=yTesting mode. Remove it once DKIM works.

Use 2048 bit RSA keys. Keys of 1024 bit still work, but are no longer recommended.

Questions

Frequently asked questions about DKIM

A DKIM record is a DNS TXT record that holds the public key receivers use to verify the signature on your email. It is published on selector._domainkey.yourdomain.

The selector is a name that points to one DKIM key. Your mail provider picks it, for example google or selector1. You find it in the s= tag of the DKIM-Signature header of an email you sent.

Enter your domain and the selector. If you leave the selector empty, the checker tries the selectors of common mail services. It shows the key, its type and any errors or warnings.

Either the selector is not the one your provider uses, or the TXT or CNAME record is not published yet. Check the s= tag in a sent message and the instructions of your mail provider.

It still works at most receivers, but 2048 bit is the recommended size. Rotate to a new key when your provider allows it.

No. The checker looks up public DNS records for the domain you enter and shows the result.