Free · live registry data · no login

DKIM Record Checker

Look up a selector and confirm the public key is published.

How it works

DKIM checker: confirm the public key behind your selector is live

Enter a domain and the DKIM selector from your provider (for example google, selector1 or k1) and we look up selector._domainkey.yourdomain over live DNS, follow any CNAME, and parse the key record: version, key type, RSA key length, hash algorithms and testing flag. Leave the selector blank and we probe nine common selectors to find whichever keys are published. You will know in seconds whether signatures from that selector can verify.

Results appear here after you click Check DKIM.

How this works

1
Build the DKIM name
The selector is combined with _domainkey and your domain to form the exact DNS name receivers query.
2
Resolve TXT and CNAME
Both are fetched live so provider-hosted keys reached via CNAME are followed correctly.
3
Parse and grade the key
Tags are split, the RSA modulus length is estimated from the key, and weak or revoked keys are flagged.

Frequently asked questions

What is a DKIM selector?: A selector is a label your provider chooses so a domain can publish several signing keys at once. It appears in the s= tag of the DKIM-Signature header, and the public key lives at selector._domainkey.yourdomain.
How do I find my DKIM selector?: Send yourself an email from the domain, open the raw headers and look for DKIM-Signature. The s= value is the selector. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2.
Is a 1024-bit DKIM key still OK?: It is still accepted by major receivers but 2048-bit is recommended and some security scanners flag 1024. Rotate to 2048 when your provider supports it; most now do.
Why does my DKIM record show as a CNAME?: Many providers host the key themselves and ask you to publish a CNAME pointing at it, so they can rotate keys without you touching DNS. This checker follows the CNAME and validates the final key.
DKIM is published but messages still fail. Why?: Common causes are the message being modified in transit (mailing lists, footers), the selector in the header not matching the published one, or the key being in testing mode. Compare the s= and d= tags in a failing message with this result.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.