DKIM Checker - Look Up and Validate DKIM Records

DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to outgoing email. The sending server signs selected headers and the body with a private key, and receivers verify the signature with the public key published in DNS at selector._domainkey.yourdomain.com.

A selector is a name that lets one domain publish several DKIM keys, for example one per email service. Find it in the DKIM-Signature header of a message you sent: the s= value is the selector and d= is the domain. Or use "Find selectors" to scan names common providers use.

Google Workspace uses "google" by default. Microsoft 365 uses "selector1" and "selector2", published as CNAMEs that point to Microsoft-hosted keys. Other services usually show their selector in the DNS setup instructions.

Use 2048-bit RSA. 1024-bit keys are still accepted but are considered weak, and keys below 1024 bits are rejected by major receivers. If your DNS host can't store a 2048-bit key in one string, split it into several quoted strings in the same TXT record.

Common causes: the message was modified in transit (mailing lists, footers, security gateways), the public key in DNS doesn't match the private key used for signing, the record has stray quotes or line breaks, or the signature's d= domain differs from the domain you checked.