DKIM Record Checker: Free Online Lookup

A DKIM record checker looks up the public key a domain publishes for email signing and shows it in readable form. Enter a domain and a selector, and this free tool returns the raw TXT record plus a table of parsed tags, so you can confirm your DKIM setup is published and has not been revoked.

What Is a DKIM Record?

A DKIM record is a DNS TXT record that holds the public key receiving mail servers use to verify that a message was signed by your domain. DKIM stands for DomainKeys Identified Mail. Your mail provider signs each outgoing message with a private key, and the receiver fetches the matching public key from DNS to check the signature.

The record lives at a special name built from three parts: the selector, the fixed label _domainkey, and your domain. For example, google._domainkey.example.com uses the selector google. The selector lets one domain publish several keys at once, for example one per email service or one per key rotation.

A typical record looks like v=DKIM1; k=rsa; p=MIGf.... It is a list of tag=value pairs separated by semicolons. The p= tag carries the public key itself, and the other tags describe how it may be used.

How to Use the DKIM Record Checker

You need two pieces of information: your domain and the selector your email service uses. Then the check takes a few seconds.

1. Type your domain into the Domain Name field, for example example.com. If you paste a full web address, the tool keeps only the domain part.
2. Enter your selector in the DKIM Selector field. You can also click one of the common selector buttons: default, google, s1, s2, mail, k1, smtp, dkim, selector1 or selector2.
3. Click Check DKIM Record.
4. Look at the line that starts with "Querying". It shows the exact DNS name that was checked, so you can spot a typo in the selector or domain.
5. Read the status: "DKIM Record Found", "Revoked DKIM Record Found" or "No DKIM Record Found".
6. If a record exists, review the Raw DKIM TXT Record and the Parsed DKIM Tags table with its Tag, Value and Meaning columns.

Selectors can contain letters, numbers, hyphens, underscores and dots, up to 63 characters. Anything else triggers a prompt to enter a valid domain name and selector.

Worked Example: Checking a Google Workspace Domain

Say you set up Google Workspace for example.com and the admin console gave you the selector google. You enter example.com and google, then click Check DKIM Record. The tool queries google._domainkey.example.com.

It returns "DKIM Record Found" and a raw record such as v=DKIM1; k=rsa; p=MIIBIjANBgkqh.... The parsed table then lists three rows:

• v with the value DKIM1, meaning the version is correct.
• k with the value rsa, meaning the key type is RSA.
• p with a long base64 string, meaning the public key is published.

That is a healthy result: the record exists, the version is valid and a key is present. If the same lookup showed p= with nothing after it, the tool would flag a revoked key instead, and any message signed with that selector would fail verification.

The same steps work for Microsoft 365. Microsoft uses the selectors selector1 and selector2, so click those buttons and run one check for each.

How Do You Read the Results?

The status line tells you the most important thing first, and the tag table tells you how the key is configured. Here is what each common tag means and what to look for.

If you see "DKIM Record Found"

A key is published at that selector. Check that v reads DKIM1 and that p contains a key. If a t=y flag appears, the domain is marked as testing, and some receivers may treat failures more leniently. Remove it once you are confident the setup works.

If you see "Revoked DKIM Record Found"

The p= value is empty, which is the standard way to retire a key. Signatures made with that selector cannot be verified. If you did not intend this, generate a new key in your email service and publish it again.

If you see "No DKIM Record Found"

Nothing was published at that exact name. Try another selector, check the spelling, and compare the name in the "Querying" line with the host name your email provider told you to create. You may also see a message that the DNS name does not exist, which means that exact selector and domain combination has no entry at all.

About long keys

The Value column shortens very long entries, so a 2048-bit key will end with an ellipsis in the table. The full text is always in the Raw DKIM TXT Record box. Long records that are stored as several quoted strings in DNS appear joined as one line.

How Do You Find Your DKIM Selector?

The fastest way to find a selector is to read it from a message you already sent. Open the full headers of an email from your domain and find the DKIM-Signature header. The s= value is the selector, and the d= value is the signing domain.

If you cannot send a test message, check your email provider's setup page. Google Workspace commonly uses google, Microsoft 365 uses selector1 and selector2, and other services often use values like s1, k1 or mail. You can paste raw headers into the email header analyzer to see the signature details and authentication results together.

If you prefer the command line, nslookup -type=txt selector._domainkey.example.com returns the same TXT record. This page just formats it and explains each tag.

Who Should Use a DKIM Lookup?

Anyone who sends email from their own domain benefits from confirming the public key is live.

• Site owners and admins who just added a DKIM record at their DNS host and want to confirm it is published.
• Marketers connecting a newsletter or CRM platform that asks for DKIM records before sending.
• Developers and IT teams checking a migration, a key rotation or a new subdomain used for transactional mail.
• Deliverability troubleshooters whose messages land in spam and who need to rule out a missing key.

DKIM is only one part of email authentication. Pair it with the SPF record checker to confirm which servers may send for your domain, and run the blacklist checker if reputation could also be hurting delivery.

Best Practices and Troubleshooting Tips

Most failed lookups come from small naming mistakes, not broken keys. Work through these checks in order.

• Enter the domain only. Use example.com, not the selector with _domainkey attached. The tool adds that part for you.
• Match the selector exactly. Selectors are specific, so google and google1 are different records.
• Check the host name at your DNS provider. Some DNS panels automatically append your domain, which can produce google._domainkey.example.com.example.com. Enter only the part before your domain if the panel adds it.
• Allow time after changes. New records can take from a few minutes to several hours to appear, depending on the record's TTL and your DNS host.
• Watch for CNAME-based setups. Some providers ask you to publish a CNAME that points to their key. The lookup follows DNS normally, but if the target is not set up on the provider's side, you will see no record.
• Use strong keys. A 2048-bit RSA key is the widely recommended size, and 1024-bit is generally treated as the minimum. Rotate keys periodically by publishing a new selector before retiring the old one.
• Remove testing flags. Leaving t=y in place after launch means receivers may not treat DKIM failures seriously.

If you see a message that DNS lookup was unavailable, wait a moment and run the check again. That message means the result could not be confirmed, not that your record is missing.

What Are the Limits of This Check?

This tool inspects one published record at a time, and a published record does not prove your mail is signed correctly. The tool does not read actual emails, so it cannot tell you whether a message passed or failed DKIM. For that, send a real message and inspect its headers.

It also cannot guess your selector. If you do not know it, use the header method above or the common selector buttons. The tag table explains the standard tags, and any tag it does not recognize appears as "Unknown tag", which is not necessarily an error.

Finally, this page does not check SPF or DMARC. A domain with a perfect DKIM key can still fail DMARC alignment if the signing domain does not match the visible From domain.

Check Your DKIM Record Now

A quick lookup confirms that your public key is published, correctly formed and not revoked, which removes one common cause of spam-folder delivery. Enter your domain and selector above, run the check, and use the results to fix the record or move on to SPF and header analysis. For more email and security utilities, browse the security and encryption tools.