DKIM record checker

What DKIM is, how it cryptographically signs your email, where the public key is published (the <code>selector._domainkey</code> selector), why it protects integrity and deliverability, and how to spot and fix the most common failures. With a free, instant check of any domain.

FREE TOOL · NO SIGN-UP

Check your domain’s DKIM now

Enter your domain and our email-authentication analyser reviews your DKIM signature together with SPF, DMARC and MX in seconds. Because DKIM relies on a selector, the analyser tries the most common ones (google, selector1, selector2, k1…); if your selector is custom, keep it handy. The analysis is instant and we don’t store your domain.

What is the DKIM record?

DKIM (DomainKeys Identified Mail, defined in RFC 6376) adds a cryptographic signature to every email leaving your domain. Your sending server signs a set of headers and the message body with a private key, and publishes the matching public key in DNS as a TXT record. When a receiving server gets the email, it reads the DKIM-Signature header, fetches your public key and verifies the signature: if it matches, it confirms a sender authorised by your domain signed it and that the content was not altered in transit. Unlike SPF, the signature travels inside the message itself.

What a DKIM record looks like and what the selector is

Every signed email carries a header with the domain (d=) and the selector (s=):

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google;
  h=from:to:subject:date; bh=…; b=…

That selector tells receivers where to find the public key in your DNS. The TXT record is published at selector._domainkey.yourdomain:

google._domainkey.example.com.  TXT
  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC…"

The selector is a name you choose (google, selector1, selector2, k1…). It lets you hold several keys at once —one per sending provider— and rotate them without breaking mail. Without knowing the selector, it is impossible to locate a domain’s DKIM record.

Why it matters: integrity, deliverability and the trio

DKIM provides two guarantees: that the message was signed by someone authorised by your domain, and that nobody tampered with its content along the way. The signature also survives forwarding better than SPF, because it travels with the message and does not depend on the delivering IP. Providers like Google and Microsoft check DKIM and weigh it when deciding your deliverability. And it is key for DMARC: for DMARC to pass an email it needs SPF or DKIM to pass with alignment to the visible domain. Together with SPF and DMARC, DKIM is one of the three pillars of email authentication.

Common mistakes that break your DKIM

Weak 1024-bit key: now considered insufficient; Google and Microsoft recommend 2048-bit RSA keys.
Missing selector: if the record is not published or the selector does not match the one signing, verification fails and the receiver cannot find the key.
Badly split TXT record: the public key (p=) is long and DNS caps each string at 255 characters, so it must be split into several quoted strings; if cut wrong, the key becomes invalid.
Test flag in production: leaving t=y (test mode) makes receivers treat the signature as non-binding.
Un-rotated key: keeping the same key for years increases the risk if it leaks.

How to set up or fix your DKIM step by step

1. Generate the key pair in your sending provider (Google Workspace, Microsoft 365, your marketing platform or CRM); it gives you the selector name and the public-key value.
2. Publish the TXT record at selector._domainkey.yourdomain with the public key you were given.
3. Enable DKIM signing in the provider’s panel and wait for DNS propagation.
4. Send a test email and verify that the DKIM-Signature header validates and that d= matches your domain.
5. Use 2048 bits, rotate the key periodically and keep a separate selector per provider.
You can check every step with our free analyser.

Frequently asked questions about DKIM

How do I check my domain DKIM record?

Enter your domain in our free analyser. Because DKIM is located via a selector, we try the most common ones (google, selector1, selector2, k1…) and tell you whether we find a valid public key, along with SPF, DMARC and MX. If you use a custom selector that does not appear by default, keep it handy to confirm it.

What is a DKIM selector?

It is the value of the s= tag in the signature and forms part of the DNS record name: selector._domainkey.yourdomain. It is used to locate the correct public key and lets you hold several keys at once (one per sending provider) and rotate them without interrupting mail.

Is a 1024-bit DKIM key secure?

It is considered weak. The current recommendation from Google and Microsoft is to use 2048-bit RSA keys. If your DKIM still signs with 1024 bits, you should regenerate the key pair at 2048 and update the TXT record.

Is DKIM enough to stop spoofing?

Not on its own. DKIM proves integrity and authorisation, but it does not tie the signature to the visible address the recipient sees, nor enforce any policy. For that you need DMARC, which requires SPF or DKIM to pass with alignment to the visible sender and defines what to do if they fail.

Sources and references

Updated: July 2026 · Informational content; not professional advice.

Keep learning

Monitor your email authentication continuously

Sign up free at OCIRIA Security and get alerts when your DKIM, SPF or DMARC changes or stops protecting your domain.

Sign up free Talk to us