🔐 DKIM Checker & Record Lookup
Check a domain's DKIM record by selector, or scan common selectors automatically, and validate the public key.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to your emails that receiving servers can verify. It proves that an email was sent by an authorized server and hasn't been modified in transit.
The DKIM record is published at selector._domainkey.yourdomain.com and contains the public key used to verify signatures.
- 2048-bit keys — Recommended minimum for security
- 1024-bit keys — Acceptable but consider upgrading
- 512-bit keys — Too weak, must be upgraded
How to Find Your DKIM Selector
DNS has no way to list a domain's DKIM selectors, so you need the one your provider uses. The quickest way to find it is in an email you sent:
- Open the raw headers of a message sent from your domain ("Show original" in Gmail, "View message details" in Outlook), or paste them into the Email Header Analyzer.
- Find the
DKIM-Signature:header. - Read
s=(the selector) andd=(the signing domain).
For example, DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; ... means the record lives at google._domainkey.example.com. Enter example.com and the selector google above.
Common DKIM Selectors by Provider
Leave the selector blank and the checker tries every named selector below automatically. Amazon SES tokens are random, so enter one of those yourself.
| Provider | Selector(s) | Record type |
|---|---|---|
| Google Workspace | google (default; can be changed) | TXT |
| Microsoft 365 | selector1, selector2 | CNAME to Microsoft |
| SendGrid | s1, s2 | CNAME |
| Mailchimp | k2, k3 (older setups: k1) | CNAME |
| Amazon SES (Easy DKIM) | Three random tokens; find them in the SES console | CNAME to dkim.amazonses.com |
| Proton Mail | protonmail, protonmail2, protonmail3 | CNAME |
| Fastmail | fm1, fm2, fm3 | CNAME |
Frequently Asked Questions
How do I check my DKIM record?
Enter your domain and, if you know it, your selector. Leave the selector blank and the checker tries the common ones. The record lives at <selector>._domainkey.<domain>, as a TXT record or as a CNAME pointing at your provider.
Why does the checker say no DKIM record was found?
Usually because your provider uses a selector the scan doesn't try: DNS can't list a domain's selectors, so a scan can only guess. Find your selector in an email's DKIM-Signature header (s=) and enter it. Otherwise the record may not be published yet, or the key was pasted with a typo.
What DKIM key length should I use?
2048-bit RSA. RFC 8301 requires at least 1024 bits and recommends 2048. A 2048-bit key is longer than the 255-character limit of a single TXT string, so DNS hosts store it as several quoted strings in one record. That's normal.
What does an empty p= mean?
The key has been revoked (RFC 6376). Mail signed with that selector will fail DKIM. That's intended if you rotated keys, and a mistake if you didn't.
If DKIM passes, does DMARC pass?
Only if the signing domain (d=) matches the domain in the From address. That's called alignment; see DMARC alignment explained.