Free DKIM Record Checker
Check that your DKIM public key is published and healthy. Enter a selector, or leave it blank and we will try the common ones. No account needed.
Free, with no sign-up. Fair-use limits apply. To enforce them we keep the domain you enter and a scrambled form of your IP address for 30 days, as described in our privacy policy.
What DKIM does
DKIM, DomainKeys Identified Mail, adds a digital signature to every message you send. The signature is created with a private key held by your email provider, and receiving servers verify it using a public key that you publish in DNS. If the signature checks out, the receiver knows the message really came from your domain and was not altered on the way. It is the second pillar of email authentication and the one that survives forwarding, which SPF does not.
The public key lives at a name made of a selector, the word _domainkey and your domain, for example google._domainkey.example.com. The selector is chosen by your email provider, which is where the difficulty starts.
Why you need a selector
DNS cannot list every name under a domain, so nobody can ask for all of a domain’s DKIM keys. You have to know the selector. It appears in the DKIM-Signature header of any email you have sent, in the s= tag, and it is usually shown in your email provider’s setup instructions.
If you do not know it, leave the box empty. The tool will try more than forty selectors that popular providers use by default, and report every key it finds. That will not find a custom selector, but it finds the majority of real-world setups.
How to use the checker
Enter your domain, optionally add a selector, and press Check DKIM. The tool looks up the record, checks that it parses correctly, reads the key type and works out the key length. Results show what was found, and anything that will cause verification to fail is listed as a problem.
What a healthy key looks like
A valid record starts with v=DKIM1 and contains a p tag holding the public key. The key should be at least 1024 bits long, and 2048 bits is the modern recommendation. The checker reports the length it found and warns about keys that are too short to trust. It also notices a few less obvious problems:
- An empty p tag, which means the key has been deliberately revoked.
- A record in test mode (t=y), which tells receivers to treat failures as harmless.
- A key that cannot be decoded, which usually means it was pasted with stray characters or line breaks.
- A selector that returns a CNAME pointing at your provider, which is normal and is followed for you.
Keeping keys healthy
A DKIM key is not something to set and forget. Providers rotate keys, staff leave, and services you stopped using may still hold a valid signing key for your domain. Review the selectors you find, and remove the ones that belong to services you no longer use. When you rotate, publish the new selector first, switch signing over, and only then retire the old record, so no message is ever signed with a key that receivers cannot find.
If no key is found
Not finding a key does not always mean DKIM is missing. The selector may be custom, or the record may have been added at the wrong name, a common mistake being to add the domain a second time so that the name ends up as selector._domainkey.example.com.example.com. Send yourself an email, open the original headers and read the s= and d= values, then try again with the exact selector.
Once DKIM is working, check that your SPF record and DMARC policy are in place, because the three work together.
Go further with an account
DKIM keys should be rotated from time to time, and forgotten ones are a quiet risk. In an SEO Web Data account you can run the full email authentication checker, which scores MX, SPF, DKIM, DMARC and more in a single report, generate a new DKIM key pair and matching record, and put the domain on a watchlist so changes to your mail records raise an alert. Create a free trial account to try the complete set of more than seventy domain tools.
Frequently asked questions
How do I find my DKIM selector?
Open the full headers of an email you sent and look for the s= value in the DKIM-Signature header, or check your email provider’s setup guide.
Can I have more than one DKIM key?
Yes. Each selector is a separate key, and many domains use several, one for each service that sends on their behalf.
Is a 1024-bit key still acceptable?
It still works with most receivers, but 2048 bits is recommended for anything new.
Does this tool see my private key?
No. Only the public key is published in DNS, and that is all the checker reads.
More free tools
See all free domain tools, or read how the email authentication tools work inside the dashboard.