DKIM Record Checker
Verify that your DKIM signing keys are published correctly. Enter a domain and selector — or leave the selector empty to search 45 common ones used by Google Workspace, Microsoft 365, Mailchimp, SendGrid and others — and see each key's syntax, type, size and status.
Enter the domain and, if you know it, the selector (from the s= tag of an email's DKIM-Signature header). We look up selector._domainkey.domain over DNS-over-HTTPS and check the record: version, key type, estimated RSA key size (1024-bit is weak, 2048-bit recommended), revoked keys and testing mode.
Instant Results
Live checks in seconds
Nothing Stored
No logs of what you check
No Sign-Up
Free, no credits or email
Suggest a Feature or Improvement for DKIM Record Checker
Need custom options, higher limits, or extra format support? Let our engineering team know!
How to use DKIM Record Checker
- 1Enter your domain.
- 2Enter the selector, or leave it blank to search common selectors.
- 3Review each key found.
- 4Rotate weak or revoked keys at your email provider.
How DKIM works
Your mail server signs each outgoing message with a private key; receivers fetch the matching public key from DNS at selector._domainkey.yourdomain and verify the signature. A valid DKIM signature proves the message wasn't altered and came from an authorised sender — and unlike SPF it survives forwarding.
Selectors let you have several keys at once, for different providers or for key rotation.
Finding your selector
DNS doesn't allow listing a domain's selectors, so no tool can find every one. Open an email you sent, view the original message, and find DKIM-Signature: … s=selector. Then make sure DMARC is set to use it.
Frequently Asked Questions
Why can't it find my DKIM record?
Your provider may use an unusual selector. Check the s= value in a sent email's headers and enter it.
Is a 1024-bit DKIM key OK?
It still works, but 2048-bit is recommended and some receivers treat 1024-bit keys as weaker. Rotate when you can.
What do you do with the domains and URLs I check?
Our server performs the lookup once and returns the result to your browser. We don't store the addresses you check or build a history. Private and internal addresses are blocked.
Guides & Tutorials
Related Tools
SPF Record Checker
Validate a domain's SPF record, count DNS lookups against the limit of 10, and see the include tree.
DMARC Record Checker
Check a domain's DMARC policy, reporting and alignment — and get a starter record if it's missing.
Domain Security Checker
Scan a domain's email, DNS and HTTPS security: SPF, DMARC, DNSSEC, CAA, SSL, HSTS and headers.