Email

DKIM Record Lookup

DKIM Records

Look up DKIM records

Enter a domain name and selector to check its DKIM (DomainKeys Identified Mail) records and verify email authentication signatures.

The s= tag from a DKIM-Signature header

DNS Resolver

Most domains return the same records on every resolver — the choice matters during DNS propagation, or when a filtering resolver blocks a domain.

No DKIM lookup results yet

Enter a domain above and click Check DKIM Records to see email authentication records here.

Tool features

Comprehensive DKIM record analysis with validation and detailed parsing
4 checks

DKIM Authentication

Verify DKIM digital signatures for email authentication

Key Strength Analysis

Decode the public key and flag weak, testing or revoked keys

Multi-Selector Support

Sweep the common provider selectors in one pass

Fast Analysis

Quick DKIM record lookup with detailed parsing

What is a DKIM record & how it works

How a domain signs and authenticates its mail

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. The sending server signs each message with a private key, and receivers verify the signature against a public key published in your DNS — proving the message really came from your domain and wasn't altered in transit.

The public key lives in a TXT record at <selector>._domainkey.example.com. The selector (the s= tag from a DKIM-Signature header) lets a domain run several keys at once. This tool reads the record for a selector, decodes the key, and flags weak, testing or revoked keys.

Selector
Names which DKIM key to use, e.g. google._domainkey.example.com.
p= tag
The base64 public key. An empty p= means the key has been revoked.
Key length
RSA keys should be 1024-bit or larger; 2048-bit is recommended.

How to use this tool

Check a domain's DKIM key in four steps
1
Enter a domain
Type a domain, e.g. example.com — the domain whose signing keys you want to inspect.
2
Add the selector
Enter the selector from a DKIM-Signature header’s s= tag, or tick “Check all known selectors” to sweep common provider selectors.
3
Run the lookup
Click Check DKIM Records to read the public key record and decode its tags.
4
Review the results
Confirm the key algorithm and length, watch for testing or revoked keys, and follow the diagnostics.

Related tools

Keep debugging with tools from the same suite
4 tools
DKIM Generator
Generate DKIM keys and records for email message signing and authentication
SPF Lookup
Check Sender Policy Framework (SPF) records for email authentication and mail server authorization
DMARC Lookup
Check DMARC policy records for email authentication, reporting, and policy enforcement
TXT Lookup
Retrieve TXT records including SPF, DKIM, DMARC, and verification records

Frequently asked questions

Common questions about DKIM records
5 Q&A

A DKIM record is a TXT record holding the public key receivers use to verify the cryptographic signature on your outgoing mail, proving it came from your domain unaltered.

A selector names which key to use, so a domain can run several keys at once. It is the s= tag in a DKIM-Signature header, and the record lives at selector._domainkey.example.com.

Open a message you sent and look at the DKIM-Signature header — the s= tag is the selector. Common ones include google, selector1/selector2 (Microsoft) and k1 (Mailchimp). Or use “Check all known selectors”.

Use at least a 1024-bit RSA key; 2048-bit is recommended where your DNS provider supports the longer record. Ed25519 keys are also valid and much shorter.

An empty p= value means the public key has been revoked. Receivers will treat signatures for that selector as invalid, so rotate to a new selector and key.