Enter a domain and a DKIM selector to fetch the public key from DNS and validate it. Leave the selector empty to search the selectors used by common email providers.
DKIM Checker
Validate a domain's DKIM record: key size, flags and problems. Finds the selector automatically.
The selector is the name your email provider gave you (the part before ._domainkey). It also appears in the DKIM-Signature header of any message you sent, as s=. Without a selector the tool tries 23 common ones.
Check a domain's DKIM key
Enter a domain and a selector to validate the DKIM public key, its size and its flags. Leave the selector empty and the tool searches the selectors used by Google, Microsoft, Mailchimp, Zoho, Proton and others.
About the dkim checker
Check the DKIM record of any domain: whether the public key is published, how long the key is, and whether the record has problems. This DKIM checker (also called a DKIM lookup or DKIM validator) can search for the selector automatically by trying the names used by Google, Microsoft, Mailchimp, Zoho, Proton and other providers.
Also searched as: DKIM record checker · DKIM lookup · DKIM validator · DKIM selector finder · check DKIM record · DKIM key test · DKIM public key checker
What DKIM does
DKIM adds a cryptographic signature to every message you send. The receiving server fetches the matching public key from DNS at selector._domainkey.yourdomain.com and uses it to prove the message came from your domain and was not altered. Together with SPF and DMARC it is what keeps your mail out of the spam folder.
How to find your selector
The selector is the label your email provider chose, for example google, selector1 or k1. Send yourself an email, open the original message source and look at the DKIM-Signature header: the s= value is the selector and d= is the domain. Leave the selector empty in this tool and it will try the most common ones for you.
What the checks mean
The tool reads the p= tag and measures the real key size: 2048-bit RSA is the standard, 1024-bit still works but is weak, and anything shorter is rejected by some receivers. It also flags a revoked key (empty p=), a broken key caused by line breaks in the DNS record, and t=y test mode, which tells receivers to ignore DKIM failures.
How this tool works and how to read the results
Frequently asked questions
How do I check my DKIM record?
Enter your domain and the selector from your email provider, then press Check DKIM. If you do not know the selector, leave it empty and the tool searches for common selectors.
Why does DKIM say the record was not found?
Usually the selector is wrong, the TXT record was added to the wrong name (it must be selector._domainkey.yourdomain.com), or DNS has not finished propagating. Some providers use CNAME records that point to their key, which this tool follows.
What DKIM key length should I use?
2048-bit RSA. Some DNS providers limit TXT length, in which case the key must be split into several quoted strings inside one record; do not split it across several records.
Can a domain have more than one DKIM key?
Yes. Each sending service normally uses its own selector, which is also how keys are rotated without downtime.