Free DKIM Record Checker
Verify your domain's DKIM configuration in seconds. Auto-detect common selectors or enter your own to look up any DKIM record.
Will try: default, selector1, selector2, google, k1, mail, dkim, smtp
Don't have a DKIM record yet?
Generate a fresh key pair and DNS record in seconds.
How DKIM Checking Works
Query
Enter Domain & Selector
You provide a domain and selector. We form a DNS lookup at {selector}._domainkey.yourdomain.com.
DNS Lookup
Live DNS Query
We query Google's DNS-over-HTTPS API for TXT records at the DKIM subdomain and find the public key record.
Result
Parsed Breakdown
The DKIM record is parsed into individual tags — version, key type, public key, and more.
What is DKIM and Why Check It?
DKIM cryptographically signs your emails, proving to receiving servers that the message came from your domain and was not altered in transit.
How to Read Your DKIM Record
v=DKIM1Version — must be the first tag. Identifies this as a DKIM record.
k=rsaKey type — typically RSA. Specifies the algorithm used for the key pair.
p=...Public key — the base64-encoded public key used to verify email signatures.
t=sFlags — "s" means strict domain alignment; "y" means testing mode.
Verifies Sender Identity
A valid DKIM signature proves the email came from your domain and was not spoofed by a third party.
Protects Against Tampering
If an email is modified in transit after signing, the DKIM signature check will fail, alerting the receiving server.
How to Fix a Missing DKIM Record
Four steps to add DKIM authentication to your domain.
Generate a DKIM Key Pair
Use our DKIM Record Generator to create a fresh RSA key pair. You'll receive a public key (for DNS) and a private key (for your mail server).
Never share your private key. Only the public key goes in DNS.
Create a TXT Record in DNS
Log in to your DNS provider. Create a TXT record with the name {selector}._domainkey.yourdomain.com and paste the public key value.
Tip: Choose a meaningful selector name — common choices are default, mail, or your provider name (e.g. google).
Install the Private Key in Your Mail Server
Add the private key to your email platform — Google Workspace, Microsoft 365, Postfix, or your ESP's DKIM settings. The server will use it to sign all outgoing emails automatically.
Re-Check With This Tool
DNS changes take up to 48 hours to propagate. Come back, enter your domain and selector to confirm the record is live.
More Free DNS Tools
SPF Record Generator
Create SPF DNS records to authorize email senders
SPF Record Checker
Verify your SPF configuration is valid
DKIM Record Generator
Generate DKIM keys and DNS records
DMARC Record Generator
Create DMARC policies for email authentication
DMARC Record Checker
Check your DMARC policy and reporting config
Frequently Asked Questions
Common questions about DKIM records, selectors, and troubleshooting verification failures.
DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures. The sending mail server signs outgoing emails with a private key, and receiving servers verify the signature using the public key published in your DNS as a TXT record.
A selector is a label that identifies which DKIM key to use for verification. It forms part of the DNS lookup: {selector}._domainkey.yourdomain.com. You can find your selector in your email provider's DKIM settings, or use the auto-detect option above.
When you send an email, your mail server adds a DKIM-Signature header signed with your private key. Receiving servers look up your public key via DNS using the selector in that header, then verify the signature. If it matches, the email passes DKIM.
Google Workspace uses "google". Microsoft 365 uses "selector1" and "selector2". Mailchimp uses "k1". SendGrid uses "s1" or "s2". The auto-detect feature checks the most common ones automatically.
Yes — unlike SPF, a domain can have multiple DKIM records simultaneously, each with a different selector. This is useful when using multiple email service providers or rotating keys.
If DKIM verification fails, receiving mail servers may mark your email as spam or reject it. Common causes include key rotation issues, misconfigured DNS records, or email content modification in transit.
Still have questions?
Contact our support team →Your Next Campaign Deserves
a Clean List
Stop guessing. Stop bouncing. Start reaching the people who actually want to hear from you.
200 free credits · No credit card required · Results in minutes