DKIM checker

Bookmark

Use this free DKIM checker tool for a DKIM lookup with a known selector, or scan common selectors to inspect published DNS keys. If your record is 'selector1._domainkey.suped.com', enter 'suped.com' into the domain and 'selector1' into the selector. Without a selector, the common-selector scan cannot guarantee it will find all your DKIM records.

Check your DKIM record is valid and correct

Selector lookup

Use this DKIM checker tool with a known selector, or scan common selectors to find published keys. Inspect syntax, key length and testing flags without changing DNS. For ongoing visibility, use Suped's DMARC monitoring to track DKIM pass rates, alignment, and authentication failures over time. Use the domain health checker when you want DKIM reviewed beside SPF and DMARC for the same domain.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

DKIM lookup with or without a selector

Enter your provider's selector or leave it blank to scan common selectors. CNAMEs are followed; the common-selector scan can miss custom names.

Find common DKIM selectors and provider examples.

Find your DKIM selector in an email-header example

In DKIM-Signature, d= is the signing domain and s= is the selector. This header resolves to selector1._domainkey.example.com, with domainkey singular.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ...

Read the practical guide to DKIM selector examples.

DKIM record format and syntax checks

A DKIM TXT record holds the public key in p=, plus optional hashes and testing flags. Use the email tester to verify actual signatures and alignment.

Check DKIM signatures on a real email.

DKIM selector lookup and record checks

Inspect the public key behind a selector, including records reached through a provider CNAME. A readable DNS key does not prove that your email provider signed a message or that the signature passed DMARC alignment. Those checks require a real email.

DKIM record

google._domainkey.example.com

TXTv=DKIM1; k=rsa; p=MIGf...

Live DKIM selector lookup

Check the exact selector TXT record receivers use to verify signed mail.

Search common selectors when you do not know which DKIM name your provider uses.

Learn more

RSA

SHA-256

2048-bit

Record change guidance

Use checker results to decide whether selector DNS needs repair or rotation.

Testing mode off

t=y absent

Testing mode check

Spot t=y testing mode so it can be removed after signing is confirmed.

DKIM signature

pass

From domain aligned

Email signature context

Open the email tester to verify a real signature and alignment; this checker inspects DNS only.

Learn more

DNS provider

Selector managed in DNS

DNS provider context

Identify where the selector is managed so the right team can rotate or repair keys.

DKIM checker FAQs

Answers to common questions about validating DKIM records, reading selector results, and deciding what to fix next.

No. It performs a live DNS lookup and reports what is currently published.

It checks whether a DKIM TXT record exists at selector._domainkey.yourdomain.com. That record contains the public key receivers use to verify DKIM signed mail.

A selector is the label before ._domainkey in a DKIM DNS name. Email providers use selectors so one domain can publish multiple DKIM keys for different senders or rotations.

Each DKIM selector should return exactly one TXT record. Multiple records for the same selector can make DKIM verification fail because receivers do not know which public key to use.

A valid DKIM record contains a usable p= public key and valid tag-value syntax. It may include v=DKIM1, k=, h=, and t= tags, separated by semicolons.

RSA is the most widely supported DKIM key algorithm. Ed25519 can be secure, but support is still less consistent, so RSA remains the safest compatibility choice.

DKIM signatures should use SHA-256, not SHA-1. A key record's h= tag describes acceptable hashes; it does not prove which signing algorithm a message used. Inspect a real message with the email tester to verify its signature.

For RSA DKIM, 2048-bit or stronger keys are recommended. The standards minimum is 1024 bits; a 1024-bit key does not automatically mean every signature fails, but upgrading provides a stronger security margin. Follow your sending provider's key-rotation instructions.

The t=y tag marks a DKIM record as being in testing mode. Receivers may treat failures more leniently, so it should be removed after DKIM signing is confirmed.

Yes. Leave the selector blank to scan common names. If nothing is found, use the selector from your provider or a sent message's DKIM-Signature header; a common-selector scan cannot discover every possible key. Find the selector for your sending provider.

Yes. It follows CNAME records to the provider's TXT key. Enter your signing domain and selector, not the provider's CNAME target as the selector. DNS changes can take time to appear through cached resolvers.

The standalone DKIM checker validates DNS records. To see whether a real message had a passing DKIM signature and whether it aligned with the From domain, use the email tester. Verify DKIM authentication on a real message.

DMARC can pass when DKIM passes and the DKIM signing domain aligns with the From domain. For ongoing visibility into DKIM pass rates and alignment, use DMARC monitoring.