DNS diagnostics · Free developer tool
DKIM checker
Look up the DKIM public key for a selector, including a CNAME to the host that publishes it.
Look up a DKIM record
Live DNSMake sense of the result
The public key for one selector.
DKIM publishes the public half of a signing key in DNS. The name is selector._domainkey.example.com. The selector comes from the service that signs the mail, or from the s= tag of a DKIM-Signature header. This page looks up the name you enter. It does not try common selectors.
What a published key shows
A TXT record starting with v=DKIM1, or any TXT record with a p= tag, is the key. An empty p= revokes that selector. Some senders publish a CNAME at the selector name and put the TXT on the target. This checker follows one CNAME.
What this does not check
A key in DNS does not prove that a message was signed, that the signature matches, or that the mail reached the inbox. Pair the result with the SPF checker and the DMARC checker, and read SPF, DKIM and DMARC explained.
Common questions
What the result does and does not mean.
Where is a DKIM record published?
At selector._domainkey.yourdomain, usually as a TXT record. The selector is chosen by the service that signs the mail. Some providers publish a CNAME at that name and put the key on the target.
What if the checker finds no record?
The selector is often wrong. A missing name is also what you see before the record has been published. This tool does not guess selectors, and a wrong selector looks the same as a missing key.
Does a published key mean the signature is valid?
No. The TXT record shows that a public key is published. Checking a signature means verifying one message against that key. An empty p= tag revokes the key at that selector.
The next step
From DNS records to your first send.
Send transactional emails, build templates and receive replies on your own domain. 1,000 emails a month free.