Deliverability
DKIM record checker
Check a domain's DKIM setup: auto-detect common selectors like google and selector1 or test your own, and validate the key type and the public key.
Enter a domain, and optionally the selector from your provider's DNS setup instructions, to verify the published DKIM key.
Instructions
How to use this tool
- 01Enter a domain like example.com. If you know the selector from your provider's setup instructions, add it; otherwise leave it blank.
- 02Click Check DKIM record. Without a selector, the tool probes a list of common selectors like google, selector1, and k1 in parallel.
- 03Review each key found: the k tag is the key type and the p tag holds the public key.
- 04An empty p tag means the key was revoked. No result usually means your provider uses a custom selector, so check its DNS instructions.
Background
What a DKIM record is
DKIM (DomainKeys Identified Mail) lets a domain cryptographically sign its outgoing mail. The sending server adds a DKIM-Signature header, and receivers verify it against a public key published in DNS at selector._domainkey.yourdomain. A valid signature proves the message body and key headers were not altered in transit and that the signing domain vouches for the message.
The selector is the part before ._domainkey and lets one domain publish many keys: Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and API senders like SendGrid or Amazon SES generate their own per-account selectors.
Background
Why you cannot always guess the selector
Unlike SPF and DMARC, which live at fixed DNS names, DKIM records are only discoverable if you know the selector, because receivers read it from each message's signature header. A checker can probe common selector names, which this tool does, but a domain signing correctly with a custom selector will still show no result.
The authoritative way to find your selector is the s= tag in the DKIM-Signature header of any message you have sent, or your provider's DNS setup page. Paste that selector into the tool to verify the exact key receivers will use.
FAQ
Frequently asked questions
What is a DKIM selector?
The label before ._domainkey in the DNS record name, chosen by your email provider. It lets one domain publish multiple signing keys. You can read it from the s= tag in any message's DKIM-Signature header.
Why does the checker find no DKIM record for my domain?
Most often the provider uses a selector that is not in the common list. Find the exact selector in your provider's DNS instructions or the s= tag of a sent message, and enter it in the selector field.
What does an empty p= tag mean?
A published record with an empty p value means the key was revoked. Receivers treat signatures made with it as invalid. Remove the record entirely, or publish the new key, once you rotate.
Should DKIM keys be rotated?
Yes. Best practice is to rotate signing keys at least twice a year, which is easy when your provider supports two selectors: publish the new key on the idle selector, switch signing over, then revoke the old one.
More tools
Browse more free tools
Where DKIM fits in the sender rules
DKIM signing is one requirement among several that the big mailbox providers now enforce on bulk senders. Our breakdown covers what each one checks. Courier sends through your own email providers, so the signing domain stays yours.
Read the sender requirements