DKIM Checker |
A DKIM checker looks up the public key a domain publishes at selector._domainkey.domain, which
receivers use to verify the signature on its email, and checks the key's type, length and flags.
Find the Selector from an Email
Paste the headers of a message from the domain: the DKIM-Signature header names the domain (d=) and selector (s=).
Read in your browser: the headers are not sent anywhere.
To see headers: Gmail, ⋮ then "Show original"; Outlook, File then Properties (desktop) or "View message source"; Apple Mail, View then Message then All Headers. The email header analyzer also shows the DKIM result of the message.
What Is DKIM?
DKIM signs each outgoing message with a private key; the matching public key sits in DNS, so any receiver can check that the message wasn't changed and really comes from the signing domain.
The key is a TXT record (or a CNAME to your mail provider's record) at selector._domainkey.yourdomain.
Each mail service you use signs with its own selector. For DMARC, the signing domain (d=) must match
the From domain. Keys can't be listed from DNS, which is why a checker needs the selector.
| Service | Usual selectors |
|---|---|
| Google Workspace | google |
| Microsoft 365 | selector1, selector2 (CNAMEs to Microsoft's keys) |
| Mailchimp | k1, k2, k3 |
| SendGrid | s1, s2 |
| Proton Mail · Fastmail | protonmail, protonmail2, protonmail3 · fm1, fm2, fm3 |
How This DKIM Check Works
| Query | Live TXT query through Google Public DNS, no cache, at selector._domainkey.domain; a CNAME to the mail provider is followed |
| Without a selector | The default selectors of common services are tried (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Proton, Fastmail, Zoho, HubSpot and generic names) |
| Key checks | Key type and length (RSA under 1024 bits refused, 1024 weak, 2048 good; Ed25519), test mode (t=y), revoked key (empty p=) |
| Not checked | Whether a real message's signature verifies: that needs the message itself (see the email header analyzer) |
| Same as | The DKIM part of the TXT lookup |
| Runs on | Our server in the US (AWS, N. Virginia). Pasted headers stay in your browser |
Last verified 10 November 2026.
Frequently Asked Questions
How do I check a DKIM record?
nslookup -type=txt selector._domainkey.example.com.
How do I find my DKIM selector?
s= is the selector and d= the domain. Paste the headers in the box on this page
and it reads them for you.
Can a domain have several DKIM keys?
Should my DKIM key be 1024 or 2048 bits?
Put this guide into practice