DKIM Record Checker
Verify a domain publishes the DKIM keys receivers need to validate its mail.
Free, no signup — the answer appears right here.Try:
What DKIM does
DKIM (DomainKeys Identified Mail) cryptographically signs every outgoing message. Your mail server signs with a private key; receivers fetch the matching public key from a DNS record at <selector>._domainkey.yourdomain.com and verify the signature. A valid signature proves the message body and key headers weren't altered in transit and that the signer controls your DNS.
Unlike SPF, DKIM survives forwarding — the signature travels with the message — which is why mailbox providers weight it heavily.
What this checker looks for
The report probes the selectors used by the major providers (google, default, selector1/selector2 for Microsoft 365, k1 for Mailchimp and friends) and validates any keys it finds: present, syntactically valid, and long enough — 1024-bit RSA is the floor, 2048-bit the standard.
DKIM only authenticates mail that's actually signed. Tying it to the visible From: address — and telling receivers what to do when it fails — is DMARC's job, checked in the same report.
Methodology & data sources
We probe the selectors the major providers actually use — google, default, selector1/selector2 (Microsoft 365), k1, s1/s2, dkim, mail — with live DNS queries at check time, then parse any key we find: syntax, key type, and RSA length (1024-bit floor, 2048-bit standard).
One honest limit: DKIM selectors are arbitrary, so a domain using a custom selector can sign perfectly while every common-selector probe comes back empty. "No selectors found" here means exactly that — not "no DKIM." If you know your selector, the full report accepts custom selectors.
Frequently asked questions
What is a DKIM selector?
A name that picks which key to use, published at <selector>._domainkey.<domain>. Providers choose their own: Google uses 'google', Microsoft 365 uses 'selector1'/'selector2', many ESPs use 'k1' or 'default'. Your sending provider's docs list yours.
My DKIM record exists but mail still fails — why?
Usual suspects: the provider is signing with a different selector than the one you published, the key was rotated but DNS wasn't updated, the record was split incorrectly across TXT strings, or the signing domain doesn't align with your From: domain (which fails DMARC even when the signature verifies).
1024-bit or 2048-bit keys?
2048-bit. 1024-bit still validates but is considered weak; some receivers score it down. If your DNS host has TXT length limits, split the key across quoted strings — resolvers reassemble them.
Do I need DKIM if I already have SPF?
Yes. SPF breaks on forwarding and only checks the envelope sender. Gmail and Yahoo's bulk-sender requirements expect both, plus DMARC.