Skip to main content
Book Consultation →
Email100% FreeInstant

DKIM Checker: Verify a DKIM Record by Selector

This free DKIM checker looks up the DKIM public key for a domain and selector, then checks the version, key and key length. Not sure of your selector? Leave it empty and the tool tries the common ones.

By Debmedia Technologies LLP · Kolkata, India · Updated

What Is DKIM?

DKIM, short for DomainKeys Identified Mail, adds a digital signature to every email you send. The matching public key is published in your DNS, so receiving servers can verify that the message really came from your domain and was not changed on the way.

The key lives in a TXT record at selector._domainkey.yourdomain.com. The selector is simply a label that lets you keep more than one key, for example one per email provider. This DKIM checker fetches that record and tests it.

How to Use This DKIM Checker

  1. Enter your domain, such as example.com.
  2. Enter the selector from your email provider, for example google or selector1.
  3. Not sure of it? Leave the selector empty and the tool tries around 17 common selectors.
  4. Press Check DKIM and read the checks for each key found.

How to Find Your Selector

Your email provider shows it in the domain setup page. You can also open any message you sent, view the original source and look for the DKIM-Signature header. The s= value is the selector and d= is the domain.

ProviderTypical selector
Google Workspacegoogle (or a custom name you chose)
Microsoft 365selector1 and selector2
Many hosting panelsdefault
Marketing toolsk1, s1, s2 or a provider-specific name

Understanding the Checks

  • Record found. A DKIM record exists at that selector.
  • Key length. 2048-bit RSA is recommended. 1024-bit still works but is weaker, and shorter keys should be replaced.
  • Empty p= value. The key was revoked. Mail signed with it will fail.
  • Testing mode (t=y). The domain is still in test mode, so some receivers ignore failures. Remove it once everything works.

The tag rules are defined in RFC 6376, the DKIM specification.

Common DKIM Problems

The record is not found

The selector may be wrong, or the record may not have propagated. Some DNS panels also add your domain automatically, which creates a doubled name such as selector._domainkey.example.com.example.com. Check the name in your panel.

The key is cut off

Long keys must be split into several quoted strings inside one TXT record. Most panels do this for you, but a pasted key with line breaks or spaces can break it.

Signing is not turned on

Publishing the record is only half the job. Your email service must also be set to sign outgoing mail with that selector.

Next Steps

DKIM is one of three parts of email authentication. Review the other two with the sender policy analyzer and the DMARC record checker, then confirm that incoming mail reaches the right servers with the MX record viewer.

Why Verify DKIM Regularly?

Keys get rotated, providers change and DNS panels sometimes alter records quietly. Running a DKIM checker after any change to your mail setup confirms that the public key is still published correctly and strong enough to trust.

Frequently Asked Questions

A selector is a name that points to one DKIM key. The record lives at selector._domainkey.yourdomain, so a domain can have several keys at once.
Your email provider shows it in its domain setup page, and it also appears in the s= tag of the DKIM-Signature header of any message you send.
Use 2048-bit RSA where your DNS provider allows it. 1024-bit keys still work but are considered weaker, and anything shorter should be replaced.
An empty public key means the selector has been revoked. Receivers will fail any message signed with it, so publish a new key if you still need that selector.

Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.