DKIM record checker
Enter a domain and its DKIM selector to read the live signing record from DNS. We confirm a public key is published and flag common problems like an empty (revoked) key or test mode.
What DKIM and the selector are
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing mail. The matching public key lives in DNS at <selector>._domainkey.yourdomain, where the selector is chosen by your sending platform. This tool reads that record and confirms the key is published and healthy.
You need the selector to look it up — find it in your sending provider's DKIM settings, or in the 'DKIM-Signature' header of a message you've sent (the s= tag).
- Record present — receivers can verify your signature only if the key is published
- Public key (p=) — an empty p= means the key was revoked
- Test mode (t=y) — signals receivers to ignore failures; remove once live
Finding your selector
- Check your ESP's authentication or domain settings for the DKIM record
- Open a sent email's headers and read the s= value in DKIM-Signature
- Common defaults: 'default', 'google', 's1'/'s2', 'k1', 'selector1'
- Rotate keys periodically and remove old selectors you no longer use
Frequently asked questions
Where do I find my DKIM selector?
In your sending platform's DKIM/authentication settings, or in the 's=' tag of the DKIM-Signature header on an email you've already sent.
The record exists but the key is empty — why?
An empty p= tag means the key was revoked. Publish a fresh key from your sending platform, or remove the record if the selector is retired.
Do I need DKIM if I already have SPF?
Yes. DKIM survives forwarding where SPF can break, and DMARC needs at least one of the two aligned. Run all three for real protection.
Start sending in minutes
Create a free account, connect your domain and reach your audience across every channel — no credit card needed.
Free plan forever · No credit card required · Set up in minutes