About the DKIM Record Checker
DKIM signs outgoing email so receivers can verify it came from your domain and was not altered. The public key is published in DNS at selector._domainkey.yourdomain. This DKIM checker queries that record in public DNS for the domain and selector you enter, or tries a list of common selectors used by popular providers if you are not sure which one applies.
It reports the key type and flags a revoked key, which is published with an empty p= value. A missing or revoked key means signatures cannot be verified, which can cause DMARC failures if SPF does not align either. If no key is found, enable DKIM in your email provider's settings and publish the record it gives you.
How to use it
- Enter your domain and DKIM selector if you know it.
- Or let the tool try common selectors.
- Check that a key is found, its type and that it is not revoked.
- Publish or fix the record at your DNS host if needed.
Frequently asked questions
What is a DKIM selector?
A selector is a label that lets one domain publish several DKIM keys, for example one per email service. It appears as s= in the DKIM-Signature header of a sent email, and the key is found at selector._domainkey.yourdomain. Each sending service usually has its own selector.
How do I find my DKIM selector?
Open a message you sent, view the original or full headers, and find the DKIM-Signature line. The value after s= is the selector, and d= shows the signing domain. Your email provider's admin console also lists it. Enter that selector here to look it up.
What does a revoked DKIM key mean?
A DKIM record with an empty p= tag means the key has been revoked, so signatures using it will fail. This is done intentionally when rotating keys. If you did not revoke it, regenerate DKIM in your provider and publish the new key.