Developer

DKIM Record Checker

Fetch a DKIM TXT record at <selector>._domainkey.<domain>, parse the public key tags, and flag revoked keys or testing flags.

Loading interactive tool…

Embed this tool on your site

About this tool

The DKIM Record Checker fetches the TXT record at <selector>._domainkey.<domain> (RFC 6376), where DKIM publishes its public key. You provide the domain plus the selector your platform uses (Google Workspace uses google; SendGrid uses s1/s2; Mailchimp uses k1). The tool shows the raw record, breaks every tag into a table with a plain-English meaning, flags revoked selectors (empty p=) and testing mode (t=y), where receivers may treat failures as benign rather than enforcing. It also shows an estimated key length, but that estimate is currently unreliable: a standard 2048-bit key is reported as 1024 bits with a red warning, so confirm the size with openssl before acting on it. Because DKIM is the only one of SPF, DKIM, and DMARC that survives mail forwarding intact, a correct DKIM key is essential for newsletters, group lists, and any high-volume sender. Use this to confirm a new selector is live and to debug failed signatures after a DNS change.

Why use it

  • Resolves the correct <selector>._domainkey.<domain> path automatically.

  • Parses every DKIM tag — v, k, p, t, s, h, n — and explains what each does.

  • Shows the raw record and every tag so you can copy the p= key out for an exact size check with openssl.

  • Flags revoked selectors (empty p=) and testing flags (t=y) that downgrade enforcement.

  • Runs as a single TXT lookup — fast, cheap, and zero-data-leakage.

  • Pairs with our SPF and DMARC checkers for the full email-auth audit.

How to use

  1. Enter the apex domain — for example, example.com.
  2. Enter the selector your sending platform uses — common ones include google, k1, s1, selector1, mte.
  3. Click Check DKIM to fetch the TXT at <selector>._domainkey.<domain>.
  4. Review the raw record and the parsed tag table (v, k, p, t, s, h, n).
  5. Treat the inferred key length as approximate — it currently reports 2048-bit keys as 1024 — and confirm the size with openssl.
  6. Cross-check that DMARC is alignment-compatible with the d= tag your platform signs with.

When it helps

  • After provisioning a new email sending platform that publishes its own DKIM selector.
  • When DMARC reports show DKIM failures and you need to confirm the published key matches what's signing.
  • While rotating from a 1024-bit legacy key to a 2048-bit modern key.
  • When migrating between selectors to verify both old and new are reachable during the transition.
  • When a vendor's DKIM signature stops verifying suddenly — often a DNS sync issue at the publishing zone.
  • On any new domain to confirm DKIM is live before tightening DMARC to p=quarantine or p=reject.

Examples

Selector that does not exist

Input
example.com / wrongselector
Expected result
No DKIM record found at wrongselector._domainkey.example.com. Verify the selector matches the one your sending platform publishes (common selectors: google, k1, s1, selector1, mte).

Revoked legacy selector

Input
example.com / mailchimp-old
Expected result
v=DKIM1; k=rsa; p= → empty public key, selector revoked

Testing mode flag still set

Input
staging.example.com / s1
Expected result
v=DKIM1; t=y; k=rsa; p=... → t=y testing flag is active, failures won't enforce

Tips

  • Don't guess the selector — pull it from the DKIM-Signature header of a real outbound message (s= field).
  • Most ESPs use predictable selector names; google for Workspace, k1 for Mailchimp, s1 for SendGrid, selector1 for Microsoft 365.
  • If p= is empty, the selector is revoked — rotate to a new selector and update DNS at the same time.
  • The t=y flag means receivers may treat failures as testing rather than enforcing — remove it once you trust the key.
  • If your platform supports it, publish two selectors and rotate keys without an outage by switching d= signing in the platform first.

Frequently Asked Questions

Is the queried record forwarded to a third party?
No. The TXT lookup runs from our backend against public DNS. Nothing is logged, stored, or shared.
Where do I find my DKIM selector?
It's in the s= tag of the DKIM-Signature header on a real outbound message. You can also find it documented in your sending platform's setup guide — Google Workspace uses google, SendGrid uses s1/s2, Mailchimp uses k1.
How does this compare to mxtoolbox or dnschecker?
It returns the same DNS data for free, with no signup, and adds an inferred-key-length warning. We don't yet validate a real signature against the record — that's a future addition.
Is the inferred key length reliable?
It is estimated from the byte length of the p= value, without parsing the key. The current size ranges are off by one step: a standard 2048-bit key is shown as 1024 bits with a red warning, a 3072-bit key as 2048, a 4096-bit key as 3072, and a 1024-bit key gets no estimate. Confirm the real size with openssl on the decoded key.
Should I act on the 1024-bit warning?
In this tool the warning is currently triggered by standard 2048-bit keys, so check the size with openssl before acting. If your key really is 1024 bits, RFC 8301 recommends at least 2048 for signing and you should rotate it at your sending platform.
Can this detect a misconfigured DKIM signature?
It checks the published key. It does not verify a real signature on a captured email — for that, paste the message into the Email Header Analyzer.
What does t=y mean in the output?
Testing mode. Receivers may treat DKIM failures as benign rather than enforcing them. It's safe during rollout but should be removed once the deployment is verified.
What does the s= tag (service type) mean?
An optional restriction on which protocols can use the key — usually * (any) or email. Most domains leave it blank or set to *.

Explore the category

SPF Record Checker Look up and parse a domain's SPF DNS record. Counts the record's own lookup mechanisms against the RFC 7208 ten-lookup limit and flags soft/hard fail qualifiers. DMARC Record Checker Look up the DMARC TXT record at _dmarc.<domain>, parse every tag (p, sp, pct, rua, ruf, adkim, aspf), and flag missing aggregate report addresses or partial enforcement. Email Header Analyzer Summarize Received chains and auth hints from pasted headers. MX Record Lookup Look up a domain's MX records, sorted by priority, and see which known email provider runs its mail servers. DNS Propagation Checker Compare a DNS record across the Cloudflare, Google and Quad9 public resolvers to see whether a recent change has reached them. DNSSEC Checker Look up DS, DNSKEY, and RRSIG records for a domain to confirm DNSSEC is enabled and inspect the chain-of-trust artifacts.
JSON Schema Explained: Validate Your APIs Like a Pro JSON Schema gives you contract-driven validation for any JSON payload. We walk through the spec, the keywords that matter, and how it powers Mar 2026 · 9 min

Glossary

DKIM
DomainKeys Identified Mail — RFC 6376 — a public-key signature scheme that proves a message was authorized by the domain in the d= tag.
DKIM selector
A short label that, combined with _domainkey.<domain>, identifies which key signed a message. Published in the s= tag of the DKIM-Signature header.
_domainkey
The fixed DNS subdomain under which all DKIM selectors live, per RFC 6376. The full record path is <selector>._domainkey.<domain>.
RSA key length
The bit length of the RSA public key. RFC 8301 deprecated 1024-bit keys; 2048 bits is the modern minimum, with 4096 used for high-value domains.
p= tag
The base64-encoded public key. An empty p= is a revocation marker — the selector is no longer active.
Testing flag (t=y)
A DKIM tag that signals receivers that this selector is in test mode and failures should not be enforced. Remove once you trust the deployment.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities