Does the DKIM checker change my DNS?

No. It performs a live DNS lookup and reports what is currently published.

What does the DKIM record found check mean?

It checks whether a DKIM TXT record exists at selector._domainkey.yourdomain.com. That record contains the public key receivers use to verify DKIM signed mail.

What is a DKIM selector?

A selector is the label before ._domainkey in a DKIM DNS name. Email providers use selectors so one domain can publish multiple DKIM keys for different senders or rotations.

Why does each selector need a single DKIM record?

Each DKIM selector should return exactly one TXT record. Multiple records for the same selector can make DKIM verification fail because receivers do not know which public key to use.

What makes a DKIM record valid?

A valid DKIM record contains a usable p= public key and valid tag-value syntax. It may include v=DKIM1, k=, h=, and t= tags, separated by semicolons.

Why does the checker prefer RSA?

RSA is the most widely supported DKIM key algorithm. Ed25519 can be secure, but support is still less consistent, so RSA remains the safest compatibility choice.

Why does SHA-256 matter for DKIM?

DKIM signatures should use SHA-256, not SHA-1. A key record's h= tag describes acceptable hashes; it does not prove which signing algorithm a message used. Inspect a real message with the email tester to verify its signature.

Why does DKIM key length matter?

For RSA DKIM, 2048-bit or stronger keys are recommended. The standards minimum is 1024 bits; a 1024-bit key does not automatically mean every signature fails, but upgrading provides a stronger security margin. Follow your sending provider's key-rotation instructions.

What does DKIM testing mode mean?

The t=y tag marks a DKIM record as being in testing mode. Receivers may treat failures more leniently, so it should be removed after DKIM signing is confirmed.

Can I run a DKIM check without a selector?

Yes. Leave the selector blank to scan common names. If nothing is found, use the selector from your provider or a sent message's DKIM-Signature header; a common-selector scan cannot discover every possible key.

Does the DKIM checker support provider CNAME records?

Yes. It follows CNAME records to the provider's TXT key. Enter your signing domain and selector, not the provider's CNAME target as the selector. DNS changes can take time to appear through cached resolvers.

Does this checker test a specific email message?

The standalone DKIM checker validates DNS records. To see whether a real message had a passing DKIM signature and whether it aligned with the From domain, use the email tester.

How does DKIM relate to DMARC?

DMARC can pass when DKIM passes and the DKIM signing domain aligns with the From domain. For ongoing visibility into DKIM pass rates and alignment, use DMARC monitoring.

DKIM checker

Bookmark

Use this free DKIM checker tool for a DKIM lookup with a known selector, or scan common selectors to inspect published DNS keys. If your record is 'selector1._domainkey.suped.com', enter 'suped.com' into the domain and 'selector1' into the selector. Without a selector, the common-selector scan cannot guarantee it will find all your DKIM records.

Check your DKIM record is valid and correct

Selector lookup

Use this DKIM checker tool with a known selector, or scan common selectors to find published keys. Inspect syntax, key length and testing flags without changing DNS. For ongoing visibility, use Suped's DMARC monitoring to track DKIM pass rates, alignment, and authentication failures over time. Use the domain health checker when you want DKIM reviewed beside SPF and DMARC for the same domain.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

DKIM lookup with or without a selector

Enter your provider's selector or leave it blank to scan common selectors. CNAMEs are followed; the common-selector scan can miss custom names.

Find common DKIM selectors and provider examples.

Find your DKIM selector in an email-header example

In DKIM-Signature, d= is the signing domain and s= is the selector. This header resolves to selector1._domainkey.example.com, with domainkey singular.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ...

Read the practical guide to DKIM selector examples.

DKIM record format and syntax checks

A DKIM TXT record holds the public key in p=, plus optional hashes and testing flags. Use the email tester to verify actual signatures and alignment.

Check DKIM signatures on a real email.

DKIM selector lookup and record checks

Inspect the public key behind a selector, including records reached through a provider CNAME. A readable DNS key does not prove that your email provider signed a message or that the signature passed DMARC alignment. Those checks require a real email.

DKIM record

google._domainkey.example.com

TXTv=DKIM1; k=rsa; p=MIGf...

Live DKIM selector lookup

Check the exact selector TXT record receivers use to verify signed mail.

Search common selectors when you do not know which DKIM name your provider uses.

Learn more

RSA