DKIM Record Checker
Verify your domain's DKIM record. Validate digital signatures and confirm your email authentication is set up correctly.
Leave the selector empty to try 28 common selectors.
What Is a DKIM Record?
DomainKeys Identified Mail (DKIM) is an email authentication method. It lets receiving servers verify your message came from your domain and was not modified in transit. DKIM adds a digital signature to every outgoing email. The receiving server checks this signature against a public key published in your DNS.
A DKIM record is a TXT record stored in your DNS at selector._domainkey.yourdomain.com. It contains your public key and configuration tags. When someone receives an email from your domain, their server retrieves this record to validate the signature. If the signature matches, the email is authenticated. If it does not match, the email may be rejected or sent to spam.
DKIM works alongside SPF and DMARC. SPF specifies which servers are allowed to send from your domain. DKIM proves your message was not tampered with. DMARC tells receivers what to do when either check fails. Together they form a complete email authentication system.
How Does DKIM Work?
DKIM uses asymmetric cryptography with two keys. Your email server holds a private key. Your DNS holds the matching public key. When you send an email, your server signs selected headers and the body using the private key. The signature is added to the email header as a DKIM-Signature field.
The DKIM-Signature header contains several tags. The s= tag specifies the selector. The d= tag identifies the signing domain. The b= tag holds the signature itself. The bh= tag contains the body hash. Together these tags tell the receiving server exactly how to verify the message.
On the receiving side, the mail server extracts the selector and domain from the signature header. It queries DNS for the TXT record at selector._domainkey.domain.com. The server retrieves the public key, computes the hash of the incoming message body and headers, and verifies the signature. If everything matches, the email passes DKIM authentication. If verification fails, the email is flagged or rejected based on your DMARC policy.
DKIM Tag Reference
| Tag | Description |
|---|---|
| v | Version of the DKIM record. Must be DKIM1. Missing this tag causes receivers to ignore the record. |
| p | Public key used to verify the digital signature. This is the core of DKIM. Without a valid p tag, email authentication fails. |
| t | Flags. t=y means the domain is testing DKIM, and receivers treat signed mail like unsigned mail. t=s means the i= domain in signatures must exactly match d=. Remove t=y once your setup is stable. |
| s | Service type. * (the default) allows all services. email limits the key to email. |
| h | Hash algorithms this key may be used with. Omit it to allow all. Use sha256. RFC 8301 says sha1 must not be used. |
| k | Key type. The default value is rsa. Ed25519 (RFC 8463) is also defined, but not every receiver supports it yet. |
| n | Notes for the human reader. This tag has no effect on DKIM validation. Use it to document the record purpose. |
Why Check Your DKIM Record?
A missing or broken DKIM record damages your email deliverability. Major email providers like Gmail and Outlook check DKIM before accepting your messages. If your record is absent or misconfigured, your emails land in spam folders or get rejected outright.
Key rotation is another reason to check. Email security best practices recommend rotating your DKIM keys periodically. After rotation, you need to confirm the new public key is published and the old record is removed. A DKIM lookup catches mismatched or stale keys before they cause problems.
Switching email service providers often changes your selector or key. If you migrate from one provider to another without updating DNS, your DKIM signatures fail. Regular checks ensure your DNS records match your current email infrastructure.
A DKIM check also reveals syntax errors. A misplaced character or an incomplete public key invalidates the entire record. The lookup tool parses your record and flags configuration mistakes so you fix them fast.
DKIM Frequently Asked Questions
DKIM, DMARC, and SPF work together to protect your email. SPF lists which servers are allowed to send from your domain. DKIM adds a digital signature so recipients know your message was not altered. DMARC ties them together and tells receiving servers what to do when an email fails authentication. Without all three, your domain is vulnerable to spoofing and phishing attacks. Checking each record regularly ensures your setup stays valid and your emails reach inboxes.
A DKIM lookup tells you whether your public key is published correctly in DNS. If the record is missing, misconfigured, or revoked, DKIM signatures fail to verify. Receivers then treat the mail as unsigned, and DMARC can only pass through SPF. Regular DKIM lookups catch problems early before they affect deliverability. This is especially important after rotating keys or changing your email service provider.
A DKIM lookup queries DNS for the TXT record at your selector._domainkey.yourdomain.com. It retrieves your public key and checks whether the record syntax is valid. The lookup confirms the key size, algorithm, and service type match your intended configuration. This information lets you fix errors before they cause email delivery failures.
Enter your domain and selector into the tool above and click Check DKIM. If you do not know the selector, leave it empty and the tool tries common selectors. You will see the public key, key length, key type, and any configuration issues. This checks the published key. To test signing, send a message to a mailbox you control and look for dkim=pass in the Authentication-Results header. Test your DKIM key after initial setup and after any DNS changes to confirm everything works.
Open your terminal and run: nslookup -type=TXT default._domainkey.yourdomain.com. Replace "default" with your actual selector and "yourdomain.com" with your domain. The command returns the DKIM TXT record if one exists. If you see no answer, your DKIM record is missing or published under a different selector.
Run the following command in your terminal: dig TXT default._domainkey.yourdomain.com. Replace "default" with your selector. The dig output shows the DKIM record contents including the public key and tags. Add +short at the end for a condensed result. This method works on Linux, macOS, and most Unix systems.
Log in to your DNS management console. Navigate to your domain zone. Look for a TXT record at selector._domainkey.yourdomain.com where selector is the name your email provider assigned. Verify the record value starts with v=DKIM1 and contains a p= tag with your public key. Use the lookup tool above to confirm DNS returns the correct record.
Open a sent email and view its raw headers. Find the DKIM-Signature header. The s= tag inside the header contains your selector. For example, s=default means the selector is "default". The d= tag shows the signing domain. Use both values to query DNS for the matching DKIM record. This method helps you identify which selector a sender uses.
Creating a DKIM record takes minutes. You generate a key pair, publish the public key as a TXT record in DNS, and configure your email server to sign outgoing messages. DNS propagation adds time. Most DNS changes propagate within minutes, though some providers take up to 48 hours. You should verify the record with a DKIM lookup tool once propagation completes.
Common DKIM issues include missing DNS records, wrong selector names, expired or rotated keys, mismatched key algorithms, and syntax errors in the TXT record. Some senders forget to publish a record after switching email providers. Others use a key length below 1024 bits, which receivers reject (RFC 8301). Duplicate DKIM records under the same selector also cause validation failures. Regular DKIM checks help you catch and fix these problems quickly.
Explore more inspectors
Start your 14-day free trial
The persistent risks to corporate emails are spear phishing and email spoofing. Monitor, identify and mitigate them with DMARC+ Solution.
Start Your 14-Day Trial Now