DKIM Record Checker

What DKIM is and what gets checked

DKIM attaches a cryptographic signature to every message. The private key stays on the sending server; the public key is published in DNS. The receiver looks the public key up by selector name, verifies the signature, and learns that the message really came from your domain and was not altered in transit.

This tool checks what can be checked from the outside: whether a key is published, whether it parses, its type and length, whether it has been revoked and whether testing mode was left switched on. Verifying the signature on a specific message is not possible from here — that needs the message body and headers.

About selectors

A DKIM record lives at selector._domainkey.example.com. The selector name is chosen by the sending service and there is no universal list. DNS offers no way to ask which selectors a domain has — you can only test a specific name.

A negative probe therefore proves nothing. When you see "none of the common selectors found", it means exactly that: no record exists under the names we tried. Only your own selector gives a definitive answer — take it from the s= tag of the DKIM-Signature header on a sent message.

Selectors used by popular services

• Google Workspace — google
• Microsoft 365 — selector1 and selector2
• Mailchimp, Klaviyo — k1
• SendGrid, Zoho — s1 and s2
• Postmark — pm
• Campaign Monitor — cm

What a record looks like

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

The v tag is optional and defaults to DKIM1. k sets the key type, rsa by default. p is the public key in base64. When copying a key out of a provider's panel, make sure it does not get broken by line wraps — that is the most common reason a record exists yet signatures fail.