DKIM record checker
Enter your domain and the DKIM selector your mail provider gave you. If you do not know it, leave it blank and we will try the common ones.
What DKIM does
DKIM adds a cryptographic signature to every message you send. The matching public key is published in DNS under a name that includes a selector, like selector1._domainkey.yourdomain.com. Receivers fetch the key and check the signature, which proves the message really came from your domain and was not altered on the way.
Finding your selector
The selector is chosen by whoever signs your mail. Google Workspace usually uses google, Microsoft 365 uses selector1 and selector2, and many services use names like k1, s1 or default. Your provider's setup instructions show the exact DNS name; the selector is the part before ._domainkey.
If you leave the selector blank, the checker tries the common ones and lists whichever exist. A domain can have several, one for each service that sends on its behalf.
Common problems
The most frequent fault is a key that was cut off when it was pasted into the DNS panel, because long values are split into chunks and some panels mangle them. The checker tells you when the key cannot be parsed. Others are keys of 1024 bits or fewer (use 2048), a revoked key with an empty p= tag, and testing mode (t=y) left on after setup.
Frequently asked questions
- Why does the checker say no record was found?
- Either the selector is wrong or the record has not been published yet. Check the exact name your provider gave you, and remember that new DNS records can take a while to appear.
- Is 1024-bit DKIM still acceptable?
- It works with most receivers today, but 2048 bits is the recommendation and some providers warn about shorter keys.
- Can I have more than one DKIM record?
- Yes. Each selector is a separate record, so every service that sends for you can have its own key.