DKIM Record Checker
Check any domain's DKIM signing setup. See which selectors are configured and whether outbound mail is cryptographically signed.
About this check
What is DKIM?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every email your domain sends. The receiving mail server fetches your public key from DNS and verifies the signature, proving the message was not altered in transit and genuinely originated from a server you authorized.
Why the selector matters
The signature lives at a DNS name like selector._domainkey.yourdomain.com. The selector is a name your mail provider chooses (often "google", "s1", or a random string) and it is not published anywhere public. We probe 35+ common provider selectors automatically; if your provider uses something unusual, enter it in the field above for a direct check.
A "not found" result needs a second look
Unlike SPF or DMARC, which sit at fixed, guessable DNS names, DKIM can hide behind any selector. The most reliable way to find yours: send yourself a test email, view the raw source, and look for a "DKIM-Signature" header with a "s=" tag, that is your real selector.
Common DKIM mistakes
Losing signing after switching email providers (the old selector still resolves but nothing signs with it anymore), running two providers without two selectors, forgetting to rotate keys for years, and publishing DKIM without ever adding a DMARC record to make failures actionable.
FAQ
Operator questions, answered.
Is this DKIM checker free?+
Yes, completely free. Check any domain instantly, no signup, no credit card.
What is a DKIM selector and where do I find mine?+
It is the label in front of "._domainkey" in the DNS name that holds your public key. Your mail provider's documentation usually states it, or you can read it off the "DKIM-Signature" header in a raw email you sent yourself.
This says "not found" but I know I have DKIM set up, why?+
We only probe common selectors automatically. If your provider uses a custom or randomly generated one, enter it in the selector field above, we will query that exact DNS name directly.
How do I fix a missing DKIM record?+
Turn on DKIM signing in your email provider's dashboard (most, including Google Workspace, Microsoft 365, and major ESPs, generate the key for you), then publish the TXT record they give you at the selector name. Run a full cqwerty scan for a copy-paste checklist tailored to your setup.
Does key length matter, 1024-bit vs 2048-bit?+
Yes. 1024-bit DKIM keys are considered weak by current standards; Google and most major providers now default to 2048-bit. If your provider still issues 1024-bit keys, check their documentation for how to rotate to a stronger key, most support it with a settings change, not a migration.
DKIM Record Checker is one slice of the full scan.
A free cqwerty scan covers TLS, DMARC / SPF / DKIM, DNS, headers, WHOIS, exposed files and spam blocklists in a single 90 second submission.