Back to Free Tools

    DKIM Record Checker

    Verify a DKIM selector record. Validates the public key, parses every tag, and flags revoked or weak keys.

    Check a DKIM selector record

    Try:

    DKIM records live at <selector>._domainkey.<domain>. Your selector comes from your sending platform (Google, Microsoft 365, SendGrid, Mailchimp, etc.).

    What is a DKIM record?

    A DKIM record is a DNS TXT record that publishes the public half of an RSA (or Ed25519) keypair used to sign outgoing mail. It lives at <selector>._domainkey.<domain> so multiple selectors can coexist for different sending platforms. Receivers fetch it to verify the DKIM-Signature header on each message.

    A typical DKIM record looks like this:

    v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...IDAQAB

    What this DKIM checker validates

    • Whether a TXT record exists at <selector>._domainkey.<domain>
    • That the record parses as a valid DKIM record (v=DKIM1 if present)
    • Presence and validity of the p= public key
    • Whether the key has been revoked (empty p=)
    • Key type (k=) and effective key size
    • Test-mode flag (t=y) that disables enforcement
    • Selector name format and CNAME chains

    DKIM tag reference

    TagRequiredMeaning
    vRecommendedVersion. Must be DKIM1 if present and appear first.
    kNoKey type. Defaults to rsa. ed25519 is also defined.
    pYesBase64-encoded public key. Empty p= signals the key is revoked.
    tNoFlags: y = testing, s = strict (i= must match d= exactly).
    hNoAcceptable hash algorithms. Defaults to sha256.
    sNoService types the key is valid for. Defaults to *.
    nNoFree-form notes for administrators. Ignored by verifiers.

    Common DKIM selectors by provider

    ProviderTypical selector
    Google Workspacegoogle
    Microsoft 365selector1, selector2
    SendGrids1, s2 or k1
    Mailchimp / Mandrillk1, k2, k3, mandrill
    Postmark20YYMMDDHHMMSSpm
    Amazon SES<generated>._domainkey.<region>.amazonses.com
    Zoho Mailzoho._domainkey or zmail._domainkey

    How to fix common DKIM problems

    • If p= is empty, publish the new selector your provider has rotated to
    • Upgrade 1024-bit keys to 2048-bit; let your provider split the TXT into multiple strings
    • Remove t=y from production records — it disables enforcement
    • Double-check the selector spelling — selectors are case-insensitive but typos cause silent failures
    • Never publish two TXT records at the same _domainkey name; use a different selector instead
    • For DMARC alignment, prefer custom DKIM (your own d=) over the ESP's shared signing domain

    Frequently asked questions

    Related free tools

    References

    Go beyond one-off checks

    Safer Sender continuously monitors your domain's DMARC, SPF and DKIM, classifies every sender, and guides you safely from p=none to p=reject.

    Start Free View pricing