Free DKIM checker
DKIM Record Checker
Free, no sign-up. We only fetch the public URL you enter.
Short answer
Enter selector._domainkey.yourdomain.com above, or only the domain: the checker then tries the common selectors google, default, selector1, selector2, k1, s1, mail and dkim. For every record it finds it shows the key type (usually RSA), an estimate of the key length and flags such as test mode or a revoked, empty key. A healthy record has v=DKIM1, k=rsa and a 2048-bit public key in p=. For the website on the same domain, monitordefend checks uptime every five minutes.
- Free, no sign-up: selector and domain, or domain only.
- Tries google, default, selector1, selector2, k1, s1, mail, dkim.
- Shows key type, estimated key length and warning flags.
v=DKIM1 version k=rsa key type RSA p=MIIBIjANBgkqhkiG9w0BAQEF… public key Key length: about 2048 bits No test flag, key not revoked
This free DKIM checker looks up the DKIM record of any domain in seconds. Enter a selector and domain, or just the domain and let the tool try the most common selectors. It confirms that the public key is published, shows the key type and an estimate of its length and flags settings that weaken or disable signing. Use it after enabling DKIM with your email provider, when DMARC reports show DKIM failures or when messages suddenly land in spam.
What DKIM is
DKIM, DomainKeys Identified Mail, adds a cryptographic signature to outgoing emails. Your email provider signs every message with a private key that only it holds and writes the signature into a header of the message. The matching public key is published in DNS, where any receiving mail server can fetch it.
The receiver uses that public key to verify two things: that the message was signed by an authorised sender for your domain, and that the signed headers and body were not altered on the way. Unlike SPF, a DKIM signature survives forwarding, which makes it the more robust half of email authentication and an essential basis for DMARC.
How the DKIM checker works
Enter the full hostname in the form selector._domainkey.domain, for example google._domainkey.example.com, and start the check. The tool looks up the DKIM TXT record at exactly that name and shows the result in a readable format, so you can confirm the record exists and is configured correctly.
- Provider signs Private key, header d=myshop.com s=google
- Receiver looks up google._domainkey.myshop.com
- Verifies Signature matches the public key
- Result dkim=pass
If you do not know your selector, enter only the domain. The checker then tries a list of common selectors one after the other: google, default, selector1, selector2, k1, s1, mail and dkim. Every selector with a published key appears in the result. If your provider uses a custom selector that is not on the list, look it up in its DKIM setup screen and enter it directly.
- The raw DKIM record for each selector found
- Key type, usually RSA, sometimes Ed25519
- An estimate of the key length from the public key
- Flags for test mode, revoked keys and missing records
What a DKIM selector is
A selector is a label that lets you publish several DKIM keys for the same domain. The key for selector google lives at google._domainkey.example.com, the key for selector1 at selector1._domainkey.example.com. Each signed message names its selector in the s= tag of the signature header, so the receiver knows which key to fetch.
Selectors are useful for several reasons. Different email providers can each have their own key, so your newsletter tool and your office mail sign independently. They also make key rotation and migrations safer: you publish a new key under a new selector, switch signing over, and remove the old key once no messages signed with it are in transit.
Reading a DKIM record
A DKIM record is a TXT record made of tag-value pairs separated by semicolons. Most of them are optional; the important part is the public key.
- v=DKIM1 — version; if present it must come first
- k= — key type, rsa by default, ed25519 for newer setups
- p= — the public key in Base64; empty means the key is revoked
- t=y — test mode; receivers may treat failures leniently
- t=s — strict; the signing domain must match exactly, no subdomains
- h= — allowed hash algorithms, such as sha256
When you should check DKIM
A missing or broken DKIM key does not produce an error message in your mailbox. Messages still go out; they simply fail authentication on the receiving side. Check your record in these situations:
- After enabling DKIM in Google Workspace, Microsoft 365 or an email-sending tool
- When DMARC reports show DKIM failures
- If emails start landing in spam or get rejected
- After changing DNS provider or migrating nameservers
- When rotating keys, to confirm the new selector is live
Why a DKIM record is not found
The most common reason is simply the wrong selector. Your provider decides the selector, and it is not always one of the common names. The second reason is the wrong DNS provider: the record was added at a service that is not responsible for your domain, because the nameservers point elsewhere. The third is the wrong hostname, often because the DNS panel appends the domain automatically and the record ends up at google._domainkey.example.com.example.com.
Some providers, Microsoft 365 among them, publish DKIM through CNAME records that point to a key hosted by the provider. That is correct, but the target only works once DKIM has been activated in the provider’s admin panel. Long keys can also be split into several quoted strings inside one TXT record, which is fine, as long as no characters were lost when copying.
Key length: 1024 or 2048 bits?
The length of an RSA key decides how hard it is to break. 2048-bit keys are generally preferred and are the default at most large providers today. 1024-bit keys still work and are accepted by receivers, but they are considered the minimum, and some providers only offer them because older DNS panels struggle with long TXT values.
Follow your provider’s guidance and choose 2048 bits where you can. The checker estimates the length from the published key so you can see which one is in use. Rotating keys regularly, for example once a year, limits the damage if a private key ever leaks.
The record exists but DKIM still fails
If the checker finds a valid key and messages still fail DKIM, compare the d= and s= tags in a failing message header with what you checked. You may be sending from a different domain, or your provider may sign with a different selector. DNS caches can also hold old values until their TTL expires, and some providers only start signing after you press an activation button.
Message changes on the way break signatures too: mailing lists that add footers or alter subjects, and security gateways that rewrite links. In those cases DKIM fails even though your setup is correct, which is why DMARC accepts a pass from either SPF or DKIM.
Mail authentication and your website
monitordefend does not monitor DKIM keys or other DNS records; use this checker after each change to your mail setup. It watches the website on your domain instead, with an uptime and response time check every five minutes and an email when something breaks.
Frequently asked questions
Can I check DKIM without knowing the selector?
Partly. Enter only the domain and the checker tries a list of common selectors such as google, default, selector1, selector2, k1, s1, mail and dkim. If your provider uses a custom or date-based selector, find it in the DKIM-Signature header of a sent message: the s= tag is the selector and the d= tag is the signing domain.
What does t=y mean in a DKIM record?
It marks the key as being in test mode. Receivers may treat failing signatures more leniently, so the flag is useful during setup but should be removed once signing works reliably.
Where do I find my DKIM selector?
Your email provider or sending platform shows it in its DKIM setup screen. Common selectors are google, selector1, selector2 and default; some providers generate a custom value. A received message also names it in the s= tag of its DKIM-Signature header.
Why does the DKIM checker say record not found?
Usually the selector is wrong, the record was added at a DNS provider that is not active for your domain, or it was created under the wrong hostname. It must sit exactly at selector._domainkey.domain.
Can I have multiple DKIM records for one domain?
Yes. Each selector has its own record under _domainkey of your domain, so different providers can sign independently and you can rotate keys without downtime.
What DKIM key length should I use, 1024 or 2048?
2048-bit keys are generally preferred when your provider and DNS host support them. 1024-bit keys still work but are the minimum.
My DKIM record exists, why is DKIM still failing?
Common causes are sending from a different domain, signing with a different selector, DNS caches holding old values, or a provider that has not started signing yet. Compare the d= and s= tags in a failing header with your record.
What is the difference between DKIM and DMARC?
DKIM signs email so receivers can verify it. DMARC tells receivers what to do when SPF and DKIM fail and checks that the signing domain aligns with the visible From domain.
How long do DKIM DNS changes take to propagate?
It depends on the TTL and on caching. Many updates appear within minutes, but some resolvers keep old values until their cache expires.