DomainDNSCheck

DKIM Record Checker

Enter a domain and the DKIM selector used by your email service. The checker fetches the public key record and checks whether it is usable.

  • Email security
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

Find it in an email header: DKIM-Signature … s=selector.

At a glance

What it checks
Look up the DKIM public key for a selector you provide and check its presence, key type and key length.
Data source
The <selector>._domainkey TXT record for the selector you enter.
Freshness
Live check; results are cached for up to 10 minutes
Limits
Selectors cannot be discovered reliably, so only the selector you provide is checked. Methodology
Cost
Free, no account needed

Understanding the result

Why you need to provide a selector

DKIM (DomainKeys Identified Mail) lets a sending service sign each message with a private key. Receivers find the matching public key in DNS at a name built from a selector and the domain:

selector1._domainkey.example.com

A domain can have many selectors, one per service or per key rotation, and DNS offers no way to list them. Guessing common names would give incomplete and misleading results, so this tool asks you for the selector instead of pretending to discover it.

Finding your selector: open the full headers of an email sent from the service, find the DKIM-Signature header, and read the s= value. The d= value shows the signing domain. Your email provider's DKIM setup page will also list it.

What is checked

  • Record present: PASS if a DKIM record exists at the selector name, FAIL if not. A missing record means receivers cannot verify signatures made with that selector.
  • Key: for RSA keys, the public key is decoded and its length measured. 2048 bits or more is a PASS, 1024 to 2047 bits is a WARNING, and anything shorter or a key that cannot be parsed is a FAIL. An empty p= value means the key has been revoked (WARNING). Other key types such as Ed25519 are shown as INFO with their type.
  • Testing mode: a t=y flag is reported as INFO, since it asks receivers to treat the domain as testing DKIM.

The result also shows the full record and its tags, such as v, k, h and t.

Common problems

  • Record not found: check the selector spelling and confirm the record was created under the right name. Some DNS editors append the domain automatically, which can create selector1._domainkey.example.com.example.com by mistake.
  • Key split incorrectly: long 2048-bit keys exceed the 255-character limit of a single TXT string and must be split into several strings in one record. Some control panels do this for you; others require quotes around each part.
  • CNAME delegation: many providers ask you to publish a CNAME that points to a key they host and rotate. That works, as long as the target exists.
  • Short keys: if the record uses a 1024-bit key, generate a 2048-bit key under a new selector, switch signing to it and then remove the old record.

Limits of a DNS check

This tool confirms that a key is published and well formed. It cannot tell whether your mail is actually signed with that key, or whether signatures verify for real messages. To confirm end to end, send a message to an external mailbox and look for dkim=pass in the Authentication-Results header. DKIM results feed into DMARC, so check your policy with the DMARC Checker, or use the Email Security Checker for an overview of all mail records.

Frequently asked questions

Can you find my DKIM selectors automatically?

Not reliably. Selectors are arbitrary names, and DNS has no index of them. The only dependable source is a signed message header or your email provider's settings.

Is a 1024-bit DKIM key still acceptable?

It is still accepted by receivers, but 2048-bit RSA is the current recommendation. Most major email services support 2048-bit keys.

Should I delete old DKIM selectors?

Once no service signs with them, yes, or revoke them by publishing an empty p= value. Allow a few days after switching so that messages already in transit can still be verified.

Why does my record contain v=DKIM1 but no key?

An empty p= tag deliberately revokes the key. If that was not intended, copy the public key from your email service again.