Trust beats tactics™

DKIM

DKIM Checker

Enter a domain and the selector your sending platform gave you. We look up the DKIM public key in DNS, confirm it is published and readable, and tell you how long it is.

New to DKIM? Read What is DKIM in the Email Almanac.

Your sending platform chooses the selector, so look in its DKIM settings. Leave it blank and we try the common names.

How this tool works

What the checker is actually doing

  1. 1

    It goes to the right address

    A DKIM public key lives in a DNS TXT record at selector._domainkey.yourdomain.com. The selector is a short label your sending platform chooses, such as s1 or k1. Lookups run on our server, so the result does not depend on your own resolver.

  2. 2

    It reads the record

    A DKIM record holds three tags, v=DKIM1, k=rsa and p=, the public key itself. We check the key is there, that it can be read, and how long it is. An empty p= means the key has been revoked.

  3. 3

    It tells you what DNS cannot show

    This proves the key is published. It does not prove your mail is signed with it. For that, send yourself a test and look for dkim=pass in the Authentication-Results line, or paste the headers into our header analyzer.

An example record, read the way the checker reads it

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEF...

v=DKIM1
The version. Always DKIM1.
k=rsa
The key type. RSA is the safe choice.
p=
The public key. 2048 bit is the length to use.

When to use it

Reach for it in these moments

  • You just published a DKIM record

    It confirms the record landed at the right address. A common slip is typing the whole domain in the Name field, where only s1._domainkey belongs.

  • DKIM is failing and you do not know why

    Enter the selector your platform gave you and this shows whether a readable key is published at that address. If it is, the problem is something DNS cannot show, so check a test email in our header analyzer.

  • You run more than one sending platform

    Each key lives under its own selector, so you can check them one at a time and see which platform is set up and which is not.

  • Before you tighten DMARC

    DKIM is one of the two paths DMARC can pass on. Check the key is really there, then send a test and confirm dkim=pass before you tighten anything.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch. Cleaning a list does not fix a DNS record, so if this check found a problem, start here.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Run a check, then email it

  • Your setup is one half. Your list is the other.

    A record that passes proves the mail is yours. Mailbox providers also judge you on who you send to. Clean your first 1,000 addresses free.

    Clean your first 1,000 free