DKIM Record Checker
Verify DKIM DNS records. Domain + selector → TXT lookup and parse.
Quick answer
Enter a domain and DKIM selector to fetch selector._domainkey.domain and inspect the public key (p=). DKIM proves message integrity in transit — it is not an email-format or disposable-inbox check.
Queries selector._domainkey.domain
About this tool
DKIM publishes a DNS public key used to verify signatures on outbound mail. You need the correct selector from your ESP (google, s1, default, etc.).
How to use
- Enter the sending domain and the DKIM selector from your email provider.
- Run the check and confirm a TXT record with v=DKIM1 and a non-empty p= key.
- Align SPF and DMARC next so authentication results pass both aspf and adkim policies.
Common use cases
- Confirm Google Workspace / Microsoft 365 DKIM is published before enabling DMARC reject.
- Troubleshoot 'DKIM fail' in mail headers after rotating keys.
- Email security audits alongside SPF and DMARC checkers.
Example inputs
example.com with selector defaultgmail.com with selector googleCommon issues and fixes
No DKIM record found
DKIM selector._domainkey.domain TXT record is missing. Publish DKIM key via your ESP or DNS.
Wrong selector
Each DKIM key has a selector. Use the selector from your email provider (e.g. google, default).
Invalid public key
p= value must be valid base64 public key. Regenerate if corrupted.
Recommended remediation
Copy the DKIM TXT from your ESP into selector._domainkey.domain. Re-check SPF and _dmarc. For address quality (not auth), use /tools/email-validator.
Pro tips
- Keep old selectors published briefly during key rotation.
- DMARC alignment needs the DKIM d= domain to match the From domain (relaxed or strict).
- Pair with disposable/format checks when reviewing inbound lead quality.
FAQ
What is a DKIM selector?
A short label that points to a specific public key in DNS (selector._domainkey.domain). Your ESP tells you which selector to use.
Does DKIM prove an email address is real?
No. DKIM authenticates signed messages from a domain. To check address format and MX, use the Email Validator.
Why is my DKIM record empty (p=)?
Some providers publish a revoked/placeholder key with an empty p=. Generate and publish a new key from the ESP admin UI.
Related security tools
DNS Lookup
Query DNS records (A, AAAA, MX, TXT, NS, CNAME) for any domain using public DNS API.
SPF Record Checker
Fetch and parse SPF (Sender Policy Framework) records for a domain to validate email security.
DMARC Record Checker
Verify DMARC DNS records. Policy, RUA, RUF, alignment.
MX Record Lookup
Check mail server (MX) records. Priority order.
Email Validator
Validate email format and check MX records. Verify if domain accepts mail.
Run a full security check
After this tool passes, run related header and policy checks to catch transport and browser-level risks.