Donaldson R F DKIM Record Checker
Look up the DKIM public-key record for a domain and selector and check it — key strength, testing flag, revoked keys and formatting problems — or try the common selectors to find which ones exist.
DNS lookups use a public DNS-over-HTTPS service (Google Public DNS, with Cloudflare as a back-up). Only the record name is sent to it.
Already have the record text? Analyse it here
What DKIM is and how to find your selector
DKIM (DomainKeys Identified Mail) lets a sending server sign each message with a private key; the matching public key is published in DNS as a TXT record named selector._domainkey.yourdomain.com. The selector is just a label chosen by whoever set up the signing — a domain can have many (one per service). Receivers read the selector from the s= tag of the message’s DKIM-Signature header, fetch the record and verify the signature.
To find a selector, open a message you sent from that service, view its headers (see the email header analyzer, which lists each signature’s selector) and look for s=. If you cannot, Try common selectors checks about 30 names used by popular services; a domain that is signing mail may use a selector that is not on the list. Modern keys are 2048-bit RSA (1024 bits is weak; under 1024 may be rejected). An empty p= means the key was revoked, and t=y means “testing”.
A record that is found and well-formed is only half the story: the service must also be signing with the matching private key, and DMARC needs the signing domain to align with the From domain. Check the rest of the set-up with the SPF & DMARC checker, build records with the SPF and DMARC generators, and see where the domain’s mail goes with MX lookup. For other record types use DNS lookup.
Frequently asked questions
I get “no record found” but my provider says DKIM is on.
Check that the selector is exactly right (it is case-insensitive) and that the record was added to the right domain. Some providers publish a CNAME that points to their own record; that is followed automatically. New records can take a while to spread.
Why is 1024-bit flagged?
Keys of 1024 bits can be broken with enough resources and are being phased out; most providers now issue 2048-bit keys.
What is sent to the DNS service?
Only the record name, such as google._domainkey.example.com.