How do I use the DKIM Record Checker tool?

The DKIM Record Checker at Valid Email Checker reads the DKIM public-key record published in your DNS and parses every tag so you can confirm the record is well-formed. Unlike SPF (one record per domain) and DMARC (one record at _dmarc.<domain>), DKIM uses selectors: each ESP publishes its key under <selector>._domainkey.<your-domain>. The checker handles selector lookup automatically or accepts a specific one you provide.

Step by step

1. Open /dkim-record-checker.
2. Enter your apex domain (e.g. example.com).
3. Either leave the Auto-detect selector toggle on, or type a specific selector you already know.
4. Click Check DKIM Record.
5. In auto-detect mode the tool tries the eight most common selectors — default, selector1, selector2, google, k1, mail, dkim, smtp — and shows the first one that resolves.
6. The result panel shows the full TXT record and a parsed table of DKIM tags (v, k, p, h, s, t, n).

What auto-detect actually tries

Auto-detect is a sequential probe — the checker queries default._domainkey.<your-domain>, then selector1._domainkey.<your-domain>, and so on through the eight common selectors. The first one that returns a record wins. This catches most domains running Google Workspace (google), Microsoft 365 (selector1 / selector2), Mailchimp (k1), and other major providers. If you use a less common selector — mailgun._domainkey, s1.smtp._domainkey, custom selectors — auto-detect will not find it. Disable auto-detect and type the exact selector instead.

What the parsed tags mean

• v=DKIM1 — the version. Always DKIM1. If missing the record is invalid.
• k=rsa — the key type. Almost always rsa. Ed25519 exists but is rare.
• p=... — the base64-encoded public key. The biggest blob in the record. Empty p= means the key is revoked.
• h=sha256 — the hash algorithm allowed for signing.
• s=email — the service type. Always email for mail-signing keys.
• t= — flags. y means testing mode (do not enforce). s means do not allow signing for subdomains.

When the checker returns nothing

No record at any of the auto-detected selectors means one of three things: your DKIM is set up under a non-standard selector (check your ESP's "DKIM settings" page), DKIM has not been configured at all (use the DKIM Record Generator and your ESP's key), or DNS for the record has not propagated yet (wait an hour and re-check).