DKIM Checker

What is a DKIM record?

Reviewed by Prabath Thalangama · Last updated October 22, 2026

A DKIM record is a DNS TXT record at selector._domainkey.yourdomain that publishes the public key receivers use to verify the DKIM-Signature on your outgoing mail. A valid signature proves the message came from your domain unaltered. This checker fetches the key for a selector and flags missing, revoked and weak keys.

Your mail server or email provider signs each message with a private key and puts the selector (s=) and signing domain (d=) in the DKIM-Signature header. The receiver looks up s._domainkey.d to find the public key. A domain can have many selectors at once, one per service or key rotation.

There is no way to list a domain's selectors from DNS, so you need to know the one to check. The fastest way to find it is in the headers of a message you sent.

How do I check my DKIM record?

Find the selector: open a message you sent, view the original headers, and find s= in the DKIM-Signature header.
Enter the domain and the selector, then run the check.
If the record is missing, publish the TXT (or CNAME) record your email provider gives you, or generate a key pair with the DKIM generator.

How to read the results

Record: The TXT record found at selector._domainkey.domain.
Tags: v=DKIM1 (version), k= key type (rsa by default, or ed25519), p= the Base64 public key, and optional t= flags such as t=y for testing mode.
Key type and size: The algorithm and, for RSA, the key length in bits decoded from p=. 2048 bits is the current recommendation.
Findings: No record for this selector, a revoked key (empty p=), or an RSA key shorter than 1024 bits.

Common DKIM problems and how to fix them

No DKIM record found for the selector

Check the selector spelling against the s= tag in a real message. If it is correct, the record was never published or was published at the wrong name; many DNS panels add the domain automatically, so enter only selector._domainkey as the host.

Key is revoked or empty

An empty p= tag means the key has been deliberately revoked. If mail is still being signed with that selector, switch signing to an active key or publish a new one.

Weak key (under 1024 bits)

RSA keys shorter than 1024 bits are considered breakable and receivers may ignore them. Generate a 2048-bit key under a new selector, switch signing to it, then remove the old record.

DKIM passes but DMARC fails

The d= domain in the signature must align with your From domain. If a third-party sender signs with its own domain, enable custom DKIM (your domain) in that service.

Examples and command-line equivalents

A DKIM TXT record

The p= value is shortened here. 2048-bit keys exceed 255 characters, so DNS stores them as several quoted strings that receivers join.

s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Find the selector in a message header

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...

Check DKIM from the command line

dig +short TXT s1._domainkey.example.com
nslookup -type=TXT s1._domainkey.example.com

Frequently asked questions

What is my DKIM selector?

It is chosen by whoever signs your mail. Google Workspace uses google by default and Microsoft 365 uses selector1 and selector2; other providers use names like k1, s1 or a date. The reliable answer is the s= value in the DKIM-Signature header of a message you sent.

Why does Microsoft 365 use CNAME records for DKIM?

Microsoft 365 hosts the keys and rotates them for you, so you publish two CNAMEs (selector1 and selector2) that point at Microsoft's records. Copy the exact targets from the Microsoft Defender portal; this checker follows the CNAME to the key.

1024 or 2048-bit DKIM key?

Use 2048. RFC 8301 requires at least 1024 bits and recommends 2048, and 1024-bit keys are increasingly treated as weak.

How often should I rotate DKIM keys?

Every 6 to 12 months is common. Publish the new key under a new selector, switch signing, and remove the old record only after mail signed with it has been delivered.