Use this free DKIM checker to look up and validate your domain's DKIM record. Don't know your selector? Leave it blank and we'll try the common ones.
A DKIM record checker validates your domain's DomainKeys Identified Mail configuration by querying DNS records with your selector (or detecting it for you) and verifying the cryptographic signature setup for email authentication.
Check DKIM records for any selector including default, google, selector1, or custom selectors configured by your email provider.
Verify DKIM record syntax including public key format and required parameters to ensure proper authentication.
DKIM signatures prevent email tampering and verify sender authenticity, improving your email reputation.
Cryptographic signatures for email integrity
When sending an email, your mail server adds a DKIM signature to the email header using a private key. This signature covers specific parts of the email content.
The receiving server extracts the selector and domain from the DKIM signature, then queries DNS for the public key at selector._domainkey.domain.com.
The receiving server uses the public key to verify the signature. If valid, the email is authenticated and more likely to reach the inbox.
Essential for email authentication and deliverability
DKIM signatures ensure email content hasn't been modified during transit. Any changes to signed headers or body content will cause verification to fail, protecting against man-in-the-middle attacks.
Email providers like Gmail and Outlook strongly favor emails with valid DKIM signatures. Proper DKIM configuration significantly improves inbox placement rates and sender reputation.
DKIM proves that emails were actually sent from your authorized servers, not from attackers attempting to impersonate your domain. This builds trust with both email providers and recipients.
DKIM is a critical component of DMARC (Domain-based Message Authentication, Reporting, and Conformance), which provides comprehensive email authentication and reporting.
The selector tells the DKIM lookup where your public key lives
Google Workspace signs with the selector google unless an admin chose a custom prefix in the Admin console under Apps, Gmail, Authenticate email.
DNS record: google._domainkey.yourdomain.com
Microsoft 365 uses selector1 and selector2, published as CNAMEs that point to your onmicrosoft.com tenant.
DNS record: selector1._domainkey.yourdomain.com
With automated security on, SendGrid uses s1 and s2, published as CNAMEs to sendgrid.net.
DNS record: s1._domainkey.yourdomain.com
Mailgun shows the selector on your domain's DNS records page in the Mailgun dashboard: it's the part of the TXT hostname before ._domainkey.
Works for any provider: open an email you sent, view the original headers, and find the s= value in the DKIM-Signature line. That's your selector, and d= is the signing domain.
What a failed DKIM check usually means and how to fix it. Running your own server? Create a new key with the DKIM record generator.
Nothing is published at selector._domainkey.yourdomain.com. Check that you used the right selector, that the record is on the right domain (not a subdomain), and that DNS has had time to propagate.
1024-bit keys are still accepted but considered weak, and some receivers distrust them. Generate a 2048-bit key in your provider's settings and rotate to a new selector.
A missing p= tag, stray quotes, spaces inside the key or a key split wrongly across 255-character strings make the record unreadable. Copy the value again exactly as your provider shows it.
The record is fine but the message changed after signing, often because a forwarder, mailing list or security gateway added a footer or rewrote links. Sign after any gateway that modifies mail.
DKIM works alongside SPF and DMARC. Validate the rest of your setup with theSPF checkerand aDMARC check.
Learn more about DKIM and email authentication
Complete guide to implementing SPF, DKIM, and DMARC for optimal email security.
Comprehensive guide to preventing your emails from being marked as spam.
Step-by-step guide to configuring all email authentication protocols including BIMI.
Complete email security with SPF, DMARC and blacklist checks
Check your domain's SPF record to verify which mail servers are authorized to send emails on your behalf.
Check if your domain or IP is on any email blacklists that could affect deliverability.
Validate your DMARC policy and check how it aligns with your SPF and DKIM records.
Complete suite of free email tools
Everything you need to know about DKIM authentication
Need help with email authentication and deliverability? Mailwarm helps you build sender reputation and ensure your emails reach the inbox. Want the full picture? Run a free email deliverability test.
