100% Free • No Signup • Live DNS

DKIM Checker

Check your DKIM record by domain and selector. Validate the public key, syntax and email authentication configuration.

Related checks: Pair DKIM with SPF, DMARC and MX records. Email authentication guides.

Free DKIM lookup • No signup • Live DNS

Why DKIM matters

DKIM adds a cryptographic signature to outbound mail so receivers can verify messages were authorized by your domain. A missing selector, empty public key or misconfigured DNS record can break authentication — and weaken the protection SPF and DMARC provide together.

What this checker validates

One check reviews your DKIM selector record, public key, tag syntax and DNS publishing.

Selector record lookup

  • TXT at selector._domainkey
  • Selector normalization
  • Record presence check
  • Host naming validation

Find the DKIM TXT record published for your chosen selector.

Public key presence

  • p= tag detection
  • Empty key flag
  • Revoked key hint
  • Key material length

Verify the record contains a usable public key for signature verification.

Tag syntax (v, k, p)

  • Version tag v=DKIM1
  • Key type k=rsa/ed25519
  • Tag formatting rules
  • Invalid tag flag

Validate required DKIM tags and overall record formatting.

Empty or revoked key

  • Blank p= value
  • Key rotation state
  • Signing disabled hint
  • Provider mismatch

Detect empty public keys that may indicate a revoked or inactive DKIM key.

Key type & length

  • RSA key size review
  • Ed25519 support
  • Weak key warning
  • Algorithm tag check

Review key type and length for modern signing strength.

DNS host naming

  • selector._domainkey.domain
  • Multiple TXT detection
  • Wrong host publishing
  • Common selector scan

Confirm the record is published at the correct DKIM DNS host.

Common DKIM issues this tool can detect

Find configuration problems that can affect email authentication and deliverability.

Missing & wrong selector

  • No record for this selector
  • Selector typo or outdated value
  • Provider uses a different label

Invalid or empty key

  • Public key missing from record
  • Empty p= (revoked key)
  • Weak or unsupported key type

Syntax & duplicate records

  • Invalid DKIM tag format
  • Multiple TXT records at host
  • Malformed v=DKIM1 record

DNS publishing mistakes

  • Record at wrong DNS host
  • TXT split or truncated
  • Stale record after migration

Pair with SPF and DMARC for complete email authentication coverage.

How DKIM checking works

The checker queries DNS for your selector and validates the published public key.

  1. Enter domain and selector

    The selector comes from your email provider. Without a selector, DKIM cannot be checked accurately.

  2. Query the DKIM DNS record

    The tool checks TXT records at selector._domainkey.domain.

  3. Validate the public key

    We check DKIM tags, public key presence, key type and possible configuration issues.

When to check DKIM

  • After changing email providers
  • Before enforcing DMARC policy
  • When troubleshooting bounces or spam
  • Migrating to Google or Microsoft 365
  • Monthly authentication review
  • After DNS or hosting changes

Understanding DKIM results

A selector identifies your DKIM public key at selector._domainkey.yourdomain.com. Domains can use multiple selectors for separate mail systems.

Valid key

DKIM TXT record found with a public key and acceptable tag syntax.

Missing selector

No record at the selector you entered. Confirm the selector in your email provider panel.

Invalid or empty key

Record exists but tags are malformed or the public key is empty (revoked).

Not found

DNS returned no DKIM record for this selector — authentication will fail for that mail stream.

Preparing DKIM check…

Pair DKIM with SPF, DMARC and MX checks for outbound and inbound mail health.

SPF Checker

Validate SPF records and syntax.

DMARC Checker

Analyze DMARC policy and alignment.

MX Lookup

Find mail exchange records.

Domain Health Checker

Complete domain analysis in one report.

Blacklist Checker

Check domain and IP blacklist status.

DNS Lookup

Check A, MX, NS, TXT and more.

View all tools →

Need help fixing DKIM?

Send us your domain report and we’ll review the issue.

Get Help

Learn more: What is DKIM?

DKIM checks read the selector TXT record in DNS. Actual signing depends on your mail server configuration. How we check

Frequently asked questions

A DKIM selector is a label used to locate the DKIM public key in DNS. The record is usually published at selector._domainkey.domain.com.
No. DKIM records require a selector. If you do not know the selector, check your email provider’s DKIM settings.
It means no DKIM TXT record was found for the selector you entered. The domain may still use DKIM with a different selector.
An empty p= value can mean the DKIM key is revoked or invalid for signing email.