---
title: "Free DKIM checker and record validator"
description: "Check the DKIM public key of any domain. Enter a selector or let the checker try common ones, and see whether the key is valid and strong enough."
canonical_url: "https://dnsense.io/dkim-checker"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

<key-visual-subpage description="Look up the DKIM key behind a selector. Don't know yours? The checker tries the selectors of common mail services. Either way you see whether the key is valid and strong enough." highlight="DKIM checker" imageAlt="Screenshot of TXT records in the DNSense DNS manager" imageUrl="spf-checker-hero.webp" title="DKIM checker">



</key-visual-subpage>

<dkim-checker decorativeShape="top-right" highlight="DKIM record" label="Free DKIM tool" title="Check a DKIM record">



</dkim-checker>

<text-content highlight="How DKIM works" label="Guide" title="How DKIM works and how to find your selector">

DKIM (DomainKeys Identified Mail) signs every message you send with a private key. The matching public key is published in DNS, so receivers can check that the message really came from your domain and was not changed on the way. DKIM is one of the two checks behind [DMARC](https://dnsense.io/dmarc-checker), next to [SPF](https://dnsense.io/spf-checker).

The public key lives in a [TXT record](https://dnsense.io/learn/txt-records-explained) on `selector._domainkey.yourdomain.com`. The selector is a name your mail provider chooses, so one domain can have several keys at once, one per sending service.

To find your selector, send a mail to yourself and open the original message. In the `DKIM-Signature` header, the `s=` tag is the selector and `d=` is the domain. Common ones are `google` for Google Workspace and `selector1` and `selector2` for Microsoft 365.

<table>
<thead>
  <tr>
    <th>
      Tag
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        v=DKIM1
      </code>
    </td>
    
    <td>
      Marks the record as DKIM.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        k=rsa
      </code>
    </td>
    
    <td>
      The key type. <code>
        rsa
      </code>
      
       is the default, <code>
        ed25519
      </code>
      
       is also supported.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        p=
      </code>
    </td>
    
    <td>
      The public key. An empty value means the key is revoked.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        t=y
      </code>
    </td>
    
    <td>
      Testing mode. Remove it once DKIM works.
    </td>
  </tr>
</tbody>
</table>

Use 2048 bit RSA keys. Keys of 1024 bit still work, but are no longer recommended.

</text-content>

<faq :faqs="[{"question":"What is a DKIM record?","answer":"A DKIM record is a DNS TXT record that holds the public key receivers use to verify the signature on your email. It is published on selector._domainkey.yourdomain."},{"question":"What is a DKIM selector?","answer":"The selector is a name that points to one DKIM key. Your mail provider picks it, for example google or selector1. You find it in the s= tag of the DKIM-Signature header of an email you sent."},{"question":"How do I check my DKIM record?","answer":"Enter your domain and the selector. If you leave the selector empty, the checker tries the selectors of common mail services. It shows the key, its type and any errors or warnings."},{"question":"Why is no DKIM key found?","answer":"Either the selector is not the one your provider uses, or the TXT or CNAME record is not published yet. Check the s= tag in a sent message and the instructions of your mail provider."},{"question":"Is a 1024 bit DKIM key safe?","answer":"It still works at most receivers, but 2048 bit is the recommended size. Rotate to a new key when your provider allows it."},{"question":"Do you store the domains I check?","answer":"No. The checker looks up public DNS records for the domain you enter and shows the result."}]" decorativeShape="bottom-left" label="Questions" title="Frequently asked questions about DKIM">



</faq>

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.