Free tool
Look up a domain's DKIM key by selector and confirm it is published correctly.
Enter a domain to check its DKIM configuration.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email. Receiving servers fetch your public key from DNS to verify the message was not altered and genuinely came from your domain.
DKIM keys are published under a selector, such as google._domainkey.example.com. This checker fetches the key for whatever selector you enter, confirms it is present and estimates its size.
A DKIM public key is a TXT record at selector._domainkey.example.com. A typical record looks like this, with the key shortened:
google._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
v=DKIM1 identifies the record, k=rsa gives the key type and p= holds the public key in base64. A 2048-bit key is about 392 characters long, more than fits in one 255-character string, so it is split into two or more strings that are joined again when read.
Some services, including Microsoft 365, Mailchimp and SendGrid, ask you to publish a CNAME at the selector name instead, pointing at a key they host and rotate for you. The checker follows the CNAME to the key.
Enter the domain and the selector. The selector box starts with google, the name Google Workspace uses by default. The checker looks up selector._domainkey.yourdomain live from Google Public DNS (8.8.8.8), with Cloudflare (1.1.1.1) as the fallback, shows the record it found and runs the checks below. Nothing is stored.
Record found. No DKIM record at that selector is a fail. Usually that means the selector is wrong rather than DKIM being missing, which is why the result suggests common ones: google, s1, k1 and selector1.
Key present. A record with an empty p= is a fail, because an empty key means the selector has been revoked.
Key length. It estimates the size from the length of the p= value and warns when the key looks short. The estimate is rough, so compare it yourself: a 2048-bit RSA key starts MIIBIjAN and is about 392 characters, while a 1024-bit key starts MIGfMA0G and is about 216. An Ed25519 key (k=ed25519) is only 44 characters by design, so a short-key warning does not apply to it.
Common selectors by provider: google for Google Workspace, selector1 and selector2 for Microsoft 365, which rotates between the two, k1 for Mailchimp, and s1 and s2 for SendGrid. Amazon SES and many other services generate random-looking selectors, so the s= tag in the DKIM-Signature header of a message you sent is the reliable source.
A key pasted with breaks or quotes. A long key split by hand, with spaces, line breaks or extra quote marks inside p=, will not verify. Paste the value exactly as the provider gives it and let your DNS panel handle the splitting.
DKIM not switched on at the provider. Publishing the key is only half the job; the service must also be told to sign mail. Google Workspace and Microsoft 365 both have a step to start signing once the record is in place.
A selector CNAME that points nowhere. With providers that host the key, the CNAME must match the exact target they give you. A typo, or a setup not finished at the provider, leaves it pointing at a name that does not exist, and the checker reports no record.
1024-bit keys left in place. They still verify, but 2048-bit is the current recommendation. Most providers let you generate a new key under a new selector: publish it, switch signing over, then revoke the old one.
On macOS or Linux, run dig TXT google._domainkey.example.com +short. On Windows, use nslookup -type=TXT selector1._domainkey.example.com, or in PowerShell Resolve-DnsName -Name s1._domainkey.example.com -Type TXT. Replace the selector with yours.
dig shows a long key as several quoted chunks; join them without spaces before you count the characters.
DKIM works alongside SPF and DMARC: DMARC passes when SPF or DKIM passes and aligns with the From address, and DKIM is the one that survives forwarding. A PulseStack™ DNS record monitor on a paid plan can watch a TXT record, such as your DKIM key, and alert you when no record contains the value you expect. For the domain's other TXT records, use the TXT record lookup.
A selector is a label that lets a domain publish multiple DKIM keys, for example one per email provider. The DNS name is selector._domainkey.example.com. Your provider tells you which selector it uses (common ones include google, s1, k1, selector1).
Check your email provider's DKIM setup page, or inspect the DKIM-Signature header of an email you sent, where the s= tag is the selector. Enter that selector here along with your domain.
2048-bit RSA keys are the current recommendation. 1024-bit keys still work but are weaker. If this checker flags a short key, ask your provider to rotate to a 2048-bit key.
Yes, one per selector. Each service that sends mail as your domain should sign with its own selector, so a domain that uses Google Workspace and a newsletter platform will usually have at least two DKIM records, and checking one says nothing about the other.
Publish the selector with an empty key (p= with nothing after it), which tells receivers that signatures made with that key are no longer valid; this checker reports it as revoked. Once mail signed with the old key has stopped arriving, you can delete the record.
Every one runs a real check, live, with nothing to install.
PulseStack™ DNS record monitors watch TXT records, such as a DKIM key, as often as every five minutes and alert you when the value you expect disappears. Included from the Starter plan at £9 a month, with a 14-day trial and no card.