DKIM Record Checker
Check the public key behind a DKIM selector and see whether it is usable, revoked or malformed.
Use the d= domain and s= selector from a DKIM-Signature header. Blank selector runs a limited candidate search; default is only a placeholder.
No registration required. Checks run on our server using Google Public DNS. Our DNS cache lasts up to five minutes; upstream DNS caches can delay changes further. No email test allowance is used.
How to use DKIM Record Checker
- Open the original source of an email sent by the service you want to check. Find a
DKIM-Signatureheader, or obtain the signing domain and selector from that service’s domain authentication settings. - Copy the
d=value into Domain and thes=value into Selector. Ford=example.com; s=mail2026;, enterexample.comandmail2026. Do not paste the full header or._domainkeyname. - Select Check DKIM. A blank selector searches only
google,selector1,selector2,default,k1,s1ands2. The placeholder does not selectdefaultfor you. - If candidate search finds a key, enter that selector and run again to validate it. If the message has multiple signatures, inspect each domain and selector pair separately.
What this tool checks
The lookup reads TXT records at selector._domainkey.domain through Google Public DNS, following supported DNS aliases. With an explicit selector it checks:
- Whether one recognizable key record exists, whether tags are duplicated or malformed, the version when present, and whether the public-key
ptag exists. - The key algorithm: RSA or Ed25519. RSA bytes are parsed as a public key and the modulus strength is measured; Ed25519 is checked for a decoded length of 32 bytes.
- Base64 encoding, a revoked key with empty
p=, permitted hashes, email service scope, and testing or subdomain restriction flags when published.
A blank-selector search only locates candidate records; it does not validate their keys. Even a fully passing selector lookup does not verify a message’s signature, body hash, signing service configuration or DMARC alignment.
Understanding your results
Publish the key your signing provider supplied at selector._domainkey.domain. DNS cannot reliably enumerate all selectors. Message signature verification requires the original email.
| Finding | Meaning & likely cause | Next action |
|---|---|---|
| Info: candidate found / not found | A common selector has a possible key, or that candidate has no key. This search is deliberately incomplete. | Enter a found selector to validate its key, or obtain the actual s= value from a signed email. |
| Pass: key syntax / structure | The published tags or key structure satisfy the implemented check. | Confirm that your sending service is actually signing with this domain and selector. |
| Fail: selector key / tag syntax | The supplied selector has no key, multiple keys, or invalid tags. A wrong selector or incomplete DNS publication is a common cause. | Confirm d= and s=; publish one complete public key at the indicated name. |
| Fail: algorithm / structure / service scope | The algorithm is unsupported, the key cannot be decoded, the RSA key is below 1024 bits, the Ed25519 length is wrong, or the service excludes email. | Use the complete email signing key supplied by your provider; correct the named field. |
| Warning: revoked key | An empty p= explicitly revokes the selector. This differs from a missing DNS record. | Move the signer to a new valid selector. Do not restore a deliberately revoked key blindly. |
| Warning: strength / hashes / testing | RSA is 1024–2047 bits, the hash list lacks SHA-256, or t=y marks testing. | Plan key rotation, use SHA-256 and review whether testing is still intentional. |
| Unknown: DNS / candidate lookup | DNS timed out, refused the query or could not complete an alias chain. | Retry and inspect the named lookup. Do not conclude DKIM is absent from an unavailable response. |
What is DKIM and why does it matter?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to a message. The sender keeps a private key; receivers look up the corresponding public key in DNS. The selector chooses which key to retrieve, allowing a domain to use different services and rotate keys.
This tool helps investigate a newly published or rotated public key. A key record is only one part of verification: the receiver also needs the original signed message. Open a saved message in the EML viewer to find its DKIM-Signature header, then use the values here. A valid key alone does not authenticate the visible From address; DMARC policy and alignment address that relationship.
Need the exact values from your sending service? Follow How to Find Your DKIM Selector before changing a key record.
Frequently asked questions
Where do I find the selector if I cannot access DNS?
Look for s= in DKIM-Signature in the original message source. It is not the email address, the key itself, or the complete DNS hostname. If no signature exists, ask the sending service which selector it has configured.
Does a blank selector prove that my domain has no DKIM?
No. Only seven common names are searched, and a found candidate still needs a second lookup with that selector for validation. DNS does not provide a reliable list of every DKIM selector.
Can the selector point to my provider through a CNAME?
The TXT lookup follows DNS aliases within its bounded lookup process. A CNAME delegates the name to another hostname; the returned key is what gets inspected. A broken target or alias loop can prevent a conclusive result.
Why does the checker still show my old key after rotation?
Confirm that you queried the new selector. A new selector and a replacement key under an old selector are different changes. Local DNS caching lasts up to five minutes, and upstream DNS caches can continue returning older answers until expiry.
The key passes. Why does an email still fail DKIM or DMARC?
The signer may use a different selector or private key, or signed content may have changed in transit. DMARC also requires alignment with From. This tool does not verify signatures; read the guide to authentication and DMARC alignment for that distinction.