DKIM checker: DKIM record lookup and test
In short: Check DKIM records on any domain, no selector needed: auto-detects common selectors, decodes key length and flags weak, revoked or broken keys. Free. Limit: Selectors cannot be listed from DNS. Auto-detect and the deeper search only find names providers commonly use; custom or per-account selectors need to be entered.
A DKIM checker looks up the public key a domain publishes at selector._domainkey.domain and tests whether it is usable. Enter a domain and this tool tries the selectors major providers publish, decodes each key's length, and flags weak 1024-bit keys, revoked keys and records broken by DNS formatting.
Leave the selector blank to auto-detect it. Free, no account. Ten lookups a minute per IP.
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español
Sample result
acme.example has a valid 2048-bit DKIM key under the selector "google".
- Selector
- Selectors tried
- 38
- Verdict
- Valid RSA key
What this means for you
DKIM signs your mail so receivers can tell it wasn't altered; 2048-bit is the recommended size.
- Tries 38 common selectors when none is given
- Decodes each key's length from p=
- Flags weak 1024-bit and revoked keys
- Catches keys split by DNS formatting
- DKIM
- Selectors
- Key length
What is a DKIM record?
A DKIM record is the public key a domain publishes in DNS so receivers can verify its signatures. DKIM (DomainKeys Identified Mail) lets a sending server sign each message with a private key. The matching public key is published as a TXT record in DNS, and a receiver uses it to confirm two things: the message was signed by the domain in the signature's d= tag, and the signed headers and body were not changed in transit.
A typical record looks like v=DKIM1; k=rsa; p=MIIBIjANBgkq.... v= is the version, k= the key type (RSA unless it says ed25519), and p= the base64-encoded public key, which is the only required tag. Optional tags include t= flags and h=, which restricts the hash algorithms the key may be used with. The DKIM glossary entry covers the concept in more depth.
How do I find my DKIM selector?
The selector is the first label of the hostname, so a key at google._domainkey.example.com has the selector google. Selectors cannot be listed from DNS, which is why this tool auto-detects by trying the fixed names providers use. If none answers, the deeper search tries about 80 selectors through the DKIM selector finder, and you can open any key it finds in one click. If that finds nothing too, the reliable way is a message you have sent: open the raw headers and find the DKIM-Signature header. s= is the selector and d= is the signing domain.
Google Workspace: the default selector is google. The record is generated in the Admin console under Apps, Google Workspace, Gmail, Authenticate email, where you can choose a 2048-bit or 1024-bit key. The Google Workspace DKIM setup guide walks through it.
Microsoft 365: every tenant uses selector1 and selector2, published as CNAME records that point into Microsoft's DNS, for example selector1-contoso-com._domainkey.contoso.onmicrosoft.com or, on newer tenants, a hostname ending in dkim.mail.microsoft. Microsoft rotates between the two, so one CNAME can point at a target with no key published while the other is active. See the Microsoft 365 DKIM setup guide.
Other common senders: Mailchimp uses k2 and k3 (CNAMEs to dkim2.mcsv.net and dkim3.mcsv.net), SendGrid uses s1 and s2, Brevo uses brevo1 and brevo2, Zendesk uses zendesk1 and zendesk2, and Resend uses resend. Amazon SES, Postmark and HubSpot generate per-account selectors that cannot be guessed, so take those from the DKIM-Signature header.
How do I read the DKIM checker results?
Read the verdict on each key first. Each key found gets one. OK means the record parses, the key decodes and it is at least 2048 bits (or Ed25519). Weak means a 1024-bit RSA key: receivers still accept it, but 2048-bit is the current recommendation. Testing means t=y is set. Revoked means p= is empty. Error means something will stop signatures verifying.
Key length is computed by decoding the public key itself rather than estimated from the record's length. A CNAME target is shown when the selector is delegated to your provider, which tells you who controls the key: if it is a CNAME, rotation happens at the provider and you never edit the TXT value yourself.
A domain can have several valid keys at once. That is normal: each service that sends as you signs with its own selector, so finding google, s1 and k2 together simply means Google Workspace, SendGrid and Mailchimp are all set up.
How do I fix common DKIM errors?
No key found: either the selector is custom, or DKIM was never turned on at the provider. Publishing the DNS record is only half of the setup; most providers also need signing switched on in their admin panel after the record verifies.
Weak 1024-bit key: generate a new 2048-bit key under a new selector (in your provider, or with the DKIM generator if you sign mail yourself), publish it, switch signing over, then remove the old record once mail is signing with the new one. The 2048-bit key rotation guide covers the order of steps. Note that Microsoft's New-DkimSigningConfig PowerShell command defaults to 1024-bit unless -KeySize 2048 is passed.
Key split across strings: a single TXT string is limited to 255 characters and a 2048-bit key is longer, so it must be published as one record made of several strings. Some DNS panels instead create two separate records, or store the quote characters as part of the value. Both break the key; the fix is to delete the record and paste the value as one entry without quotes.
Testing mode (t=y): the key was published with the test flag, and receivers may treat mail signed with it as unsigned. Once a test message shows dkim=pass, remove t=y and leave the other tags alone. Every result short of OK on this page comes with these fix steps under the key.
Revoked key (p= empty): the selector has been deliberately retired. That is correct if nothing still signs with it, and a failure if something does. h=sha1: RFC 8301 retired SHA-1 for DKIM, so a key restricted to it cannot verify signatures; remove the h= tag.
How do I test DKIM signing on a real email?
Send yourself a message and read its headers. A published key proves the DNS side is right, not that your mail is actually signed. To test that, send a message to a Gmail or Outlook address you control and open the raw headers. In Gmail, use Show original: it shows a DKIM line reading PASS along with the signing domain.
In any client, look for the Authentication-Results header added by the receiving server. A working setup reads dkim=pass header.d=yourdomain.com and names the selector in header.s=. If header.d= shows your provider's domain instead of yours, the mail is signed but not aligned, and DMARC will not count it. Check the rest of the chain with the SPF checker, the DMARC checker and the MX lookup.
How do I check my DKIM record?
- Type your domain. Leave the selector blank to try the selectors major providers publish, or enter yours if you know it.
- Press Check DKIM. Each key found is shown with its selector, key length and raw record.
- Read each verdict: OK, Weak (a 1024-bit key), Testing, Revoked or Error.
- Under any key short of OK, follow the numbered fix steps.
- If nothing is found, run the deeper search (about 80 selectors), or take the selector from the
s=tag of theDKIM-Signatureheader in a message you sent and check that selector.
Example
- You enter
- The domain
acme.example, with no selector entered. - You get
- After trying 38 common selectors, it found a valid 2048-bit RSA key under the selector
google, published atgoogle._domainkey.acme.example. - Limits
- Ten checks a minute per IP address, one domain at a time; DNS lookups only.
Who uses this tool, and for what?
- IT admins
- Find weak 1024-bit keys and keys broken by DNS formatting before they cause failures, and confirm a rotation to a new 2048-bit selector worked.
- Cold emailers
- Confirm DKIM is published for each outreach domain at Google Workspace or Microsoft 365 before warm-up, then send a test and read the headers to confirm signing.
- Agencies
- See at a glance which services a client has set up DKIM for: finding
google,s1andk2together means Google Workspace, SendGrid and Mailchimp.
What can’t this tool tell you?
- Selectors cannot be listed from DNS. Auto-detect and the deeper search only find names providers commonly use; custom or per-account selectors need to be entered.
- A published key proves the DNS side. It does not prove your provider has signing switched on; a test message does.
- It checks the key, not alignment. If mail is signed with your provider's domain instead of yours, DMARC won't count it.
Sources
Common questions
- How do I check my DKIM record?
- Enter your domain in the DKIM checker above and leave the selector blank. It tries the selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid and other providers, then shows each key it finds with its length, flags and raw record. If you know your selector, enter it to check that one directly.
- What is a DKIM selector?
- A selector is the label that identifies which DKIM key to use, and it forms part of the DNS hostname where the public key lives: selector._domainkey.yourdomain.com. It lets a domain publish several keys at once, which is what makes key rotation possible without downtime.
- Why can't a DKIM checker find my record?
- Usually because your provider uses a selector that is custom or generated per account, which no checker can guess. Find it in the DKIM-Signature header of a message you have sent, where it appears as s=, and enter it in the selector field. If that selector also returns nothing, the record is not published.
- Is a 1024-bit DKIM key still OK?
- It still works: receivers accept 1024-bit RSA keys, and RFC 8301 sets 1024 bits as the minimum. 2048-bit is the current recommendation, and Google Workspace offers it when you generate a key. Keys shorter than 1024 bits should be treated as invalid.
- How do I know if my emails are DKIM signed?
- Send a message to an inbox you control and read the raw headers. The Authentication-Results header should say dkim=pass, with header.d= showing your own domain. A published DNS record alone does not prove signing is switched on at your provider.
- How do I check a DKIM record with nslookup?
- Run nslookup -type=txt selector._domainkey.example.com, or dig txt selector._domainkey.example.com, with your selector and domain filled in. For Google Workspace that is google._domainkey.yourdomain.com. You need the selector: DNS cannot list them, which is why this checker tries the common ones for you.
- How do I check the DKIM signature in an email header?
- Find the DKIM-Signature header for the signing domain (d=) and selector (s=), and the Authentication-Results header for the verdict, such as dkim=pass header.d=yourdomain.com. The email header analyzer shows both and says whether the signing domain aligns with the From address.
- What does DKIM permerror mean?
- It means the signature could not be verified because of a problem that will not fix itself on retry, such as a malformed key record, a missing key or an unsupported algorithm. Look up the selector here: a broken or empty key record is the usual cause.
- What does t=y mean in a DKIM record?
- It marks the key as being in testing mode. Receivers may treat signatures from a test-mode key as if the message were unsigned, so remove t=y once a test message shows dkim=pass. The checker flags it and shows the fix.
- Do I need both SPF and DKIM?
- Yes, and DMARC as well. SPF validates the sending server but breaks on forwarding and only checks the envelope sender. DKIM validates the message itself and survives forwarding. DMARC ties either result to the From address a recipient sees, which is the part that actually stops spoofing.
How do I check MX, SPF, DKIM and DMARC at once?
Run the deliverability audit: this page covers one record, and the full deliverability audit runs MX, SPF, DKIM, DMARC and blocklists together and scores the domain. Just bought a domain to send from? The new domain email setup check checks up to 25 at once and gives the exact Google Workspace, Microsoft 365 or Zoho records to add, or read the glossary entry for the concept behind this check.
Embed this tool on your site
Paste this code into any page to give your readers the DKIM checker for free. The frame resizes to fit and works on light and dark pages. Keep the link under it so readers can find the full guide. More tools to embed are on the embeddable tools page.
<iframe src="https://simpleverifier.com/embed/tools/dkim-checker" title="DKIM checker by SimpleVerifier" data-sv-embed="dkim-checker" width="100%" height="640" loading="lazy" allow="clipboard-write" style="border:0;width:100%;max-width:760px;display:block"></iframe>
<p style="margin:6px 0 0;font-size:13px"><a href="https://simpleverifier.com/tools/dkim-checker">Free DKIM checker by SimpleVerifier</a></p>
<script>(function(){if(window.__svEmbed)return;window.__svEmbed=1;window.addEventListener("message",function(e){if(e.origin!=="https://simpleverifier.com")return;var d=e.data;if(!d||d.type!=="simpleverifier:embed-height"||typeof d.slug!=="string"||typeof d.height!=="number"||!isFinite(d.height))return;var f=document.querySelectorAll("iframe[data-sv-embed]");for(var i=0;i<f.length;i++){if(f[i].contentWindow===e.source){f[i].style.height=Math.min(Math.max(Math.ceil(d.height),200),4000)+"px";}}});})();</script>You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.