DKIM Checker
ServerLook up a domain's DKIM public key by selector — or auto-detect it.
How it works
Look up a domain's DKIM public key. If you know your selector (the label your mail provider uses, e.g. google or selector1), enter it — otherwise we'll try the most common ones automatically.
Try an example
This check runs from our server so it can query DNS directly — the domain you enter is sent to our backend. Nothing is stored.
How this works: the domain you enter is sent to our server so it can query DNS directly and see what a receiving mail server sees. Nothing is stored.
About the DKIM Checker
DKIM adds a cryptographic signature to your outgoing mail, letting receivers verify the message really came from your domain and wasn't altered in transit. This free DKIM checker looks up the public key published in DNS for a given selector — or tries the most common selectors automatically if you don't know yours.
A missing or revoked DKIM key means your mail can't be verified, which hurts deliverability.
Finding your selector
DKIM keys live at <selector>._domainkey.yourdomain.com, and the selector is chosen by whoever sends your mail. Google Workspace commonly uses 'google', Microsoft 365 uses 'selector1' and 'selector2', and many services use 'default' or 'k1'. To find yours for certain, send yourself a message and look at the DKIM-Signature header — the s= value is the selector.
Frequently asked questions
What is a DKIM selector?
A label that identifies which key to use, allowing a domain to publish several. It appears as s= in the DKIM-Signature header of messages you send.
How do I find my DKIM selector?
Send yourself an email, view the raw headers, and look for s= in the DKIM-Signature header. Or let this tool try the most common selectors for your domain.
What does an empty p= value mean?
The key has been revoked. Any mail still signed with it will fail DKIM verification, so it should be replaced.
Is 1024-bit DKIM still acceptable?
It works, but 2048-bit is the current recommendation. Some receivers now treat 1024-bit keys as weak.