DKIM Record Checker
Enter a domain and selector to look up its DKIM public key record.
Common Selectors
What is a DKIM record?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail, generated with a private key the sending server holds. The corresponding public key is published as a DNS TXT record atselector._domainkey.yourdomain.com. The receiving server fetches that key and verifies the signature, confirming the message wasn't altered in transit and genuinely came from a server that holds the matching private key.
How to read the result
The important tags are k (key type, almost always rsa) andp, the base64-encoded public key itself. An empty p= value means the key has been revoked — mail signed with that selector will now fail verification.
Common failure causes
- Checking the wrong selector — every provider uses a different one, and there is no single default.
- The sending provider rotated its key but the domain owner never re-published the new selector.
- Long public keys split across multiple quoted TXT strings incorrectly, corrupting the record.
- DKIM passes but isn't aligned with the DMARC From domain, which still causes a DMARC failure.
Frequently asked questions
What is a DKIM selector?
A selector is the label prefixed to the DKIM record's hostname — for example "google" in google._domainkey.yourdomain.com. It lets a domain publish multiple DKIM keys at once (one per sending provider, or one per key rotation) without them colliding, since each provider signs with its own selector.
How many DKIM selectors can a domain have?
As many as needed — one per sending service is normal. A domain sending through Google Workspace, a CRM, and a support desk would typically have three separate selector records, each with its own key pair, and losing one does not affect the others.
Why do keys need to be 2048-bit?
1024-bit RSA keys are considered too weak for DKIM signing under current guidance from major mailbox providers, and some now reject or downgrade mail signed with them. 2048-bit is the current minimum recommended by most ESPs and mailbox providers.
Keep an eye on this automatically
A one-off check tells you how things look right now. DMARC.WS collects your aggregate reports continuously, shows you which senders are failing authentication, and alerts you when something changes.
Free plan includes 5 domains. No card required.