Domain Health · DKIM
DKIM record checker
Enter a domain and, if you know it, the selector. We'll find the public key, check its type and size, and flag revoked or test-mode keys.
How DKIM works
Your mail server signs each outgoing message with a private key. The matching public key is published in DNS at <selector>._domainkey.yourdomain.com. Receivers fetch it and verify the signature, which proves the message wasn't altered and was authorized by your domain.
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"
Finding your selector
The selector is a label your email provider picks, so there's no single place to look it up. Two reliable ways to find it:
- Your provider's admin console: the DKIM settings page shows the exact hostname to publish. Google Workspace commonly uses
google; Microsoft 365 usesselector1andselector2. - A message you sent: open it, choose "show original" or "view source", find the
DKIM-Signature:header and read thes=value. That's the selector;d=is the signing domain.
Common problems
No key found
Either the record was never published, it's under a different selector, or it was pasted with extra quotes or spaces. Publish it exactly as your provider shows. Some providers (for example Microsoft 365 and many sending services) ask for a CNAME instead of a TXT record; follow their instructions.
Weak keys
RSA keys under 1024 bits are rejected by major receivers, and 1024-bit keys are considered weak. Generate a 2048-bit key in your provider's console, publish it under a new selector, switch signing to it, then retire the old one.
Revoked or test-mode keys
An empty p= means the key was deliberately revoked, which is normal after a rotation. t=y means test mode; remove it once signing works.
DKIM matters most together with DMARC: for DMARC to pass on DKIM, the signing domain (d=) must match your visible From domain.