DKIM Checker
Look up and validate a DKIM public key by selector.
Enter a domain and its DKIM selector to look up the public key and check whether it is published and active. We read the live TXT record straight from DNS over an encrypted connection. Nothing is stored.
The DKIM Checker looks up a DKIM public key in DNS for a domain and a given selector, then validates that the record is well-formed and usable. DKIM (DomainKeys Identified Mail, RFC 6376) lets a sending server attach a cryptographic signature to outbound mail; the receiving server fetches the matching public key from selector._domainkey.yourdomain.com and verifies that the message has not been altered in transit and genuinely came from a server holding the private key.
Why DKIM matters
DKIM is one of the two authentication methods that can satisfy DMARC. A message passes DMARC when SPF or DKIM aligns with the visible From domain, so a healthy DKIM signature is often the more resilient path to passing, because DKIM survives forwarding and mailing lists better than SPF. Without a valid published key, every signed message from that selector fails verification, which depresses deliverability and undermines any move to DMARC enforcement.
How to read the result and fix problems
The tool reports the key type (k=rsa or k=ed25519), the public key in p=, and any flags. Watch for these common faults:
- No record found: the selector is wrong, or the TXT record was never published. Check the exact selector your provider uses.
- Empty
p=: this revokes the key, so remove it only if you genuinely want to retire the selector. - Weak key: 1024-bit RSA is accepted but dated, so publish 2048-bit where your DNS allows it.
- Testing mode:
t=ytells receivers to treat failures leniently, so remove it once you are confident.
If you need a fresh key, our DKIM Generator produces a key pair and record. For a full posture review across SPF, DKIM and DMARC, see how we audit.
Frequently asked questions
What is a DKIM selector and where do I find it?
A selector is a label that lets a domain publish several DKIM keys at once. The public key lives at selector._domainkey.yourdomain.com. Your email provider chooses the selector; you can also read it from the s= tag in the DKIM-Signature header of a message you sent.
Why does the checker say no record was found?
Almost always the selector is wrong or the TXT record was never published. Confirm the exact selector from a sent message's header, and allow time for DNS to propagate after publishing. A missing record means every message signed with that selector will fail DKIM verification.
Is a 1024-bit DKIM key safe to use?
1024-bit RSA still verifies and is widely accepted, but 2048-bit is the recommended minimum for new keys. Some DNS providers split long TXT values automatically; if yours does not, our record splitter can help.
What does an empty p= value mean?
An empty p= tag revokes that key, telling receivers the selector is no longer valid. This is intentional when retiring a key, but if you still send signed mail with that selector it will fail. Republish a real public key to fix it.
Does passing DKIM mean my domain is protected from spoofing?
Not on its own. DKIM proves a message was signed, but only DMARC ties authentication to the visible From address and tells receivers to reject failures. You need a DMARC policy at p=quarantine or p=reject for real protection; see how to enforce.
What is t=y in a DKIM record?
The t=y flag marks the key as being in testing mode, so receivers should not treat a DKIM failure as a strong signal. Remove it once you are confident signing works correctly, otherwise you weaken the value of your signatures.