DKIM Record Checker
Verify a domain publishes the DKIM keys receivers need to validate its mail.
Free, no signup — the answer appears right here.Try:
What DKIM does
DKIM (DomainKeys Identified Mail) cryptographically signs every outgoing message. Your mail server signs with a private key; receivers fetch the matching public key from a DNS record at <selector>._domainkey.yourdomain.com and verify the signature. A valid signature proves the message body and key headers weren't altered in transit and that the signer controls your DNS.
Unlike SPF, DKIM survives forwarding — the signature travels with the message — which is why mailbox providers weight it heavily.
What this checker looks for
The report probes 41 selectors used by the major providers (google, selector1/selector2 for Microsoft 365, k1, k2, k3 and mandrill for Mailchimp, s1, s2 and smtpapi for SendGrid, s1024/s2048 for Yahoo, and more) and reads any record it finds: whether it publishes a key (p=), whether that key has been revoked (an empty p=), the key type (k=) and testing mode (t=y). It does not decode the key or measure its length. A key at a selector outside that list is invisible from DNS, so "not found" is not proof DKIM is off.
DKIM only authenticates mail that's actually signed. Tying it to the visible From: address — and telling receivers what to do when it fails — is DMARC's job, checked in the same report.
Methodology & data sources
We probe the selectors the major providers actually use — google, default, selector1/selector2 (Microsoft 365), k1, s1/s2, dkim, mail — with live DNS queries at check time, then parse any record we find: whether p= carries a key or is empty (revoked), the key type, the version tag and the testing flag.
One honest limit: DKIM selectors are arbitrary, so a domain using a custom selector can sign perfectly while every common-selector probe comes back empty. "No selectors found" here means exactly that — not "no DKIM." If you know your selector, the full report accepts custom selectors.
Frequently asked questions
What is a DKIM selector?
A name that picks which key to use, published at <selector>._domainkey.<domain>. Providers choose their own: Google uses 'google', Microsoft 365 uses 'selector1'/'selector2', many ESPs use 'k1' or 'default'. Your sending provider's docs list yours.
My DKIM record exists but mail still fails — why?
Usual suspects: the provider is signing with a different selector than the one you published, the key was rotated but DNS wasn't updated, the record was split incorrectly across TXT strings, or the signing domain doesn't align with your From: domain (which fails DMARC even when the signature verifies).
1024-bit or 2048-bit keys?
2048-bit. 1024-bit still validates but is considered weak; some receivers score it down. If your DNS host has TXT length limits, split the key across quoted strings — resolvers reassemble them.
Do I need DKIM if I already have SPF?
Yes. SPF breaks on forwarding and only checks the envelope sender. Gmail and Yahoo's bulk-sender requirements expect both, plus DMARC.