Instantly check your DKIM record by entering your domain name and selector. Our free DKIM lookup tool verifies your public key, validates syntax, detects misconfigurations, and identifies authentication failures. Get instant results – no signup required.
For automated DKIM management and key rotation, see our Hosted DKIM service.
0+
Organisations worldwide0+
Fortune 100 and governments0+
countries servedCheck your DKIM record in 3 simple steps:
Type in your domain (e.g., yourdomain.com), no http://, www, or mail. prefix needed. If you have multiple selectors, you'll check each one separately.
The selector is a label that identifies which public key to use. Common defaults: google, selector1, selector2, k1, s1.
DKIM Results appear instantly. A pass means the DKIM record exists, is syntactically correct, and contains a valid public key.
DKIM stands for DomainKeys Identified Mail. It is an email authentication protocol that lets sending servers digitally sign messages. A DKIM record is a DNS TXT record published at selector._domainkey.yourdomain.com that contains the public key that receivers use to verify signatures on your emails. DKIM protects against content tampering and spoofing, and is a key requirement for DMARC alignment and email deliverability.
For a deeper understanding, see our:
DKIM signing and verification happen in four steps:
Your sending mail server signs the email with a private key stored on the server, creating a DKIM-Signature header that covers the message headers and body.
The signed email (with DKIM-Signature header) is sent to the receiving mail server.
The receiving server looks up the public key by querying your DNS record at selector._domainkey.yourdomain.com.
The receiver uses the public key to verify the signature. If the signature is valid, DKIM passes. If the signature is invalid or missing, DKIM fails.
Our DKIM checker runs 8 core checks on your DNS record. Here’s what each one means:
Confirms if a DKIM record exists at selector._domainkey.yourdomain.com. If no record is found, DKIM is not set up for this domain and selector.
Verifies that the record is correctly formatted per RFC 6376 (the DKIM standard), and flags missing or malformed tags.
Confirms if the p= tag is present and contains a non-empty public key. If p= is empty, the key has been revoked.
Identifies the key type: RSA (most common) or Ed25519 (newer, more efficient), and flags unknown algorithms.
Confirms if h=sha256 is set, and flags h=sha1 as deprecated and weak.
For RSA keys, flags keys under 2048 bits as weak, since RSA-2048 or Ed25519 are recommended.
Notes whether s=email is present. If absent, the record may not be processed correctly by all receivers.
Shows the full DNS query path (selector._domainkey.domain.com) to help you verify the record location in your DNS provider.
A DKIM selector is a label in your DNS that identifies which public key to use. Many organizations have multiple DKIM records – one per email service provider (ESP) or mail server. The selector tells receivers which record to look up.
Check an Email Header
Open an email sent from your domain (in Gmail, Outlook, etc.)
Click "Show original" or "View message source"
Find the DKIM-Signature header line
Look for the s= tag—that is your selector
s=google means your selector is "google" Check Your Email Provider's Admin Console
Different infrastructure providers utilize different default string structures. Use the table to reference common default selector setups.
| ESP Platform | Selectors | Infrastructure Note |
|---|---|---|
| Google Workspace | google | Single selector for all Google-hosted email deployments |
| Microsoft 365 | selector1, selector2 | Microsoft uses two keys alternately for rotation and redundancy |
| Mailchimp | k1 | Standard baseline key used heavily for transactional marketing emails |
| SendGrid | s1, s2 or s201801, s201802 | Verify your specific customer SendGrid dashboard for exact values |
| Amazon SES | Custom (varies) | You define this specific string profile manually when generating DKIM |
| Zoho Mail | zmail1 | Single default system validation selector parameter |
| Office 365 | selector1, selector2 | Follows structural alignment rules identical to Microsoft 365 cloud routing |
Make our tool auto-detect it: Skip manual lookups entirely. Let our automated scanner analyze your domain infrastructure to identify active selectors instantly.
Try common defaults like google, selector1, selector2, k1, s1, or mail
Check your email service provider's help docs (most providers show their default selector)
If you still can't find it, contact your email provider's support team
Here are the five most common DKIM issues and how to resolve them:
No DKIM Record Found
Cause: The DNS TXT record is not published at the expected location, or the wrong selector is being checked.
Recommended Fixes:
Selector Mismatch
Cause: The selector in the email's DKIM-Signature header doesn't match the selector you're checking in DNS.
Recommended Fixes:
Key Revoked (p= tag is empty)
Cause: The public key has been intentionally revoked by leaving the p= tag empty or undefined.
Recommended Fixes:
Weak Key Algorithm or Key Length
Cause: The key is RSA-1024 (too short), uses SHA-1 (deprecated), or has another weak configuration.
Recommended Fixes:
h=sha256) DKIM Passes But DMARC Fails
Cause: DKIM signature is valid, but the signing domain (d= in the DKIM-Signature header) doesn't align with the From address domain. DMARC requires alignment.
Recommended Fixes:
d= domain to the From domain
DKIM and DMARC are both email authentication standards, but they serve different purposes:
DKIM uses a private key on your mail server to digitally sign emails. Receivers verify these signatures using the public key from your DNS record. DKIM proves that a message came from an authorized mail server and wasn't altered in transit.
DMARC is a policy standard that tells receivers what to do if DKIM (or SPF) passes or fails. DMARC requires that DKIM signatures align with the From domain before trusting them.
The DKIM signature must be cryptographically valid
The signing domain (d= in the DKIM-Signature) must align with the From address domain
Example: An email signed with DKIM from mail.example.com will only pass DMARC alignment if the From address is either @example.com (exact match) or @mail.example.com with aspf=r (relaxed mode).
Instantly verify if your DMARC record is live, valid, and free of syntax errors using our free lookup tool.
DMARC Checker →PowerDMARC's hosted DMARC guides you safely from monitoring to full p=reject enforcement with real-time visibility.
Hosted DMARC →PowerDMARC automatically parses aggregate reports and alerts you when new senders appear or authentication issues arise.
Start Free →
Auckland Regional Manager, Advantage
“Our business is based on trust, not only between us and clients but partners as well. The great partnership we have with PowerDMARC allows us to deliver exceptional services to our clients.”
