DKIM Checker
Enter a domain and its DKIM selector to see whether a DKIM record is published and what it says.
Overview
DKIM (DomainKeys Identified Mail) lets a receiving mail server verify that a message genuinely came from the domain it claims to, and wasn't altered in transit, by checking a cryptographic signature against a public key published in DNS. Unlike SPF and DMARC, that key isn't at a single fixed location — it's published under a selector chosen by whichever mail provider signs the domain's outgoing mail, at `<selector>._domainkey.<domain>`. This tool queries that specific record and shows it exactly as published.
Examples
A domain with DKIM configured for the "google" selector
example.com, selector: google
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...
How It Works
- Enter a domain name, e.g. example.com.
- Enter the DKIM selector for that domain — check your email provider's DKIM setup docs if you don't know it, or try a common one like google or selector1.
- Click Check to query <selector>._domainkey.<domain> for a DKIM record.
- Review the record if one is found, or a clear "not found" result if not.
Use Cases
Confirming DKIM signing after an email provider change
Verify the new provider's DKIM key is published under the selector it expects before relying on it.
Diagnosing DMARC alignment failures
Check whether a missing or misconfigured DKIM record is the reason mail is failing DMARC's DKIM-alignment check.
Tips
- A domain can publish more than one DKIM selector at once, e.g. during a provider migration — check each selector you know about separately.
- DKIM alone doesn't prevent spoofing of the visible "From" address — it works alongside SPF and DMARC (see the SPF Checker and DMARC Checker).
FAQ
It's a name chosen by whichever provider signs the domain's outgoing mail, used to point to a specific public key at <selector>._domainkey.<domain>. Common examples include google, selector1, selector2, k1, and s1, but the exact value depends on the provider — check its DKIM setup documentation.
Either the domain hasn't set up DKIM signing for that selector, or you've entered the wrong selector — try checking your email provider's DKIM setup instructions for the correct one.
No, it only checks whether the public key record exists in DNS for the selector you provide. Validating a specific message's signature happens on the receiving mail server, not here.