Free DKIM Checker

DKIM (DomainKeys Identified Mail) signs each outgoing email with a private key held by your mail provider. The matching public key sits in a DNS TXT record under _domainkey on your domain. A receiving server verifies the signature against that key, which proves the message came from your domain and was not altered on the way.

The selector is the first label of the record name: selector._domainkey.yourdomain.com. Each mail provider chooses its own, so one domain can hold several keys, one per service. Google uses google, Microsoft 365 uses selector1 and selector2, many others use default, k1 or mail. Type yours in the selector field to check it directly.

default, google, selector1, selector2, k1 and mail, in that order, and it stops at the first key it finds. There is no way to list every selector a domain has from the outside, so a key under another name reads as not found here while it works fine in your mail.

Open a message you sent from the domain and view its headers. The DKIM-Signature header carries s=, the selector, and d=, the signing domain. Your provider's DKIM setup page names it too, together with the record you were asked to publish.

An empty p= tag means the key was revoked. A key under 1024 bits is rejected by most receivers; 2048 bits is the norm today. A record that was pasted with a line break or a missing semicolon cannot be parsed. The checker shows the record it found, so each of these is visible at once.

It queries the TXT records at the selector names through Cloudflare's public DNS over HTTPS, straight from your browser, and reads the key it finds. Nothing is sent to our servers and nothing is logged. It is free, with no signup and no limit on checks, and it shows SPF and DMARC for the same domain beside the result.