DKIM Checker
Read and audit a DKIM selector record.
Use the DKIM Checker tool
What this dkim checker does
DKIM signs outgoing messages with a private key; the matching public key is published in DNS at `<selector>._domainkey.<domain>`. Receivers verify the signature and confirm the message was not altered in transit.
Selectors are chosen by the sending platform and are not listed centrally, so you need to know the selector from a message header or your provider's documentation. This checker queries one selector and checks that the record is a valid DKIM1 key with a non-empty public key.
Why use it
- Confirm that a provider's DKIM key is published.
- Check that a key was not accidentally revoked with an empty p= value.
- Verify a selector after rotating signing keys.
How to use it
- 1Enter the domain.
- 2Enter the selector, or try a common provider selector.
- 3Review the parsed record, key presence and any warnings.
Worked examples
Provider selector
Input
Selector google on yourdomain.com
Output
A v=DKIM1 record with an RSA public key and no warnings.
Revoked key
Input
v=DKIM1; p=
Output
Failure: an empty public key revokes the selector.
Common mistakes
- Guessing the selector when a received message's DKIM-Signature header names it directly.
- Publishing the key at the wrong name, such as selector.domainkey instead of selector._domainkey.
- Rotating the private key without publishing the new public key first.
Frequently asked questions
Where do I find the selector?
In the DKIM-Signature header of a message the provider sent, look for s=. It is also listed in the provider's DNS setup instructions.
Does this verify a signed email?
No. It reads the published key. Verifying a message requires the message itself and a DKIM verifier.
Why do some providers use several selectors?
Separate selectors let a provider rotate keys without breaking mail already signed with the old key.