Free DKIM Record Checker
Discover DKIM selectors for your domain, or look up a specific selector and validate its public key.
What a DKIM record looks like
A DKIM record is a DNS TXT record published at selector._domainkey.yourdomain.com. It holds the public half of the signing key:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...v=DKIM1The version.
k=rsaThe key type. RSA is standard.
p=...The public key itself. An empty p= means the key was revoked.
selectorThe label in the hostname that points to this key.
Finding your selector
DKIM keys are not at a fixed name, so you need the selector. Common ones by provider:
selector1, selector2googlemimecast20240101smtpapi, s1, s2amazonsespmIf yours is not listed, open a message you have sent and read the s= tag in its DKIM-Signature header, then enter that selector above.
Related tools
Frequently asked questions
What is a DKIM record?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email. The matching public key is published as a DNS TXT record, so receiving servers can verify the message was really sent by your domain and was not altered in transit.
What is a DKIM selector?
A selector is a label that points to a specific DKIM key, published at selector._domainkey.yourdomain.com. It lets a domain run more than one key at once (for example one per sending service, or during a key rotation). Your email provider sets the selector name.
How do I find my DKIM selector?
Providers use known selectors: Microsoft 365 uses selector1 and selector2, Google Workspace uses google, and services like Mimecast, SendGrid and Amazon SES have their own. This checker probes the common ones automatically. If yours is custom, enter it in the selector field, or find it in a DKIM-Signature header of an email you have sent.
What key length should DKIM use?
Use a 2048-bit RSA key where your provider supports it. 1024-bit keys still validate but are weaker and are being phased out. If your provider only offers 1024-bit, that is acceptable in the short term, but plan to move to 2048-bit.
Why can this checker not find my DKIM record?
Either DKIM is not enabled with your provider, or it uses a selector outside the common set this tool probes. Enter your selector in the field above, or discover selectors over time by turning on DMARC monitoring, which reports the selectors seen in your real mail.