DKIM record checker
Look up any domain's DKIM public key by selector, estimate its strength, and catch revoked or misconfigured keys — every tag explained in plain English.
- Only the domain and selector leave your browser
- Queries go straight to Cloudflare DNS
- Free, no signup
How it works
One DNS name in, plain English out
01
Type domain + selector
Together they form the DNS name selector._domainkey.domain — the only thing this tool sends anywhere.
02
We query DNS over HTTPS
Your browser asks Cloudflare's public resolver (Google as fallback) for the TXT record and joins its quoted parts back together.
03
Plain-English verdicts
Key type and estimated strength, revoked-key detection, testing flags, and every tag explained in one sentence.
What is a DKIM record?
A DKIM record is a TXT record at selector._domainkey.yourdomain.com holding the public half of a signing key. Your mail server signs every outgoing message with the private half; receivers fetch this record to verify the signature. If the key is weak, revoked, or missing, your DKIM silently stops working — and with it a large part of your deliverability and DMARC protection.
FAQ
What is DKIM?
DKIM (DomainKeys Identified Mail) lets a sending server put a cryptographic signature on every email, carried in the DKIM-Signature header. The matching public key is published in DNS at selector._domainkey.yourdomain.com, and receivers use it to verify the message really came from your infrastructure and wasn't modified in transit. Unlike SPF, DKIM survives normal forwarding.
How do I find my DKIM selector?
Look at any message you've sent: the DKIM-Signature header contains s= (the selector) and d= (the domain). In Gmail choose “Show original”, in other clients view the raw source — or paste the headers into our email header analyzer. Your email provider's admin console also shows the selector wherever you set DKIM up.
Why is a DKIM record split into multiple quoted strings?
A single string in a DNS TXT record holds at most 255 characters, and a 2048-bit RSA public key is longer than that. DNS solves this by storing the record as several quoted strings that receivers join back together. This checker concatenates them automatically, so you always see the full key.
Is a 1024-bit DKIM key still okay?
It verifies, but it's weak by modern standards — 1024-bit RSA is considered within reach of well-resourced attackers and was deprecated by NIST years ago. Best practice is 2048-bit, which every major provider now issues. If this tool estimates your key at 1024 bits, generate a new key in your provider's settings and publish it under a new selector.
What does an empty p= value mean?
An empty p= tag is the standard way of saying the key has been revoked — mail signed with that selector no longer verifies. That's normal for old, rotated-out selectors, but if it's the selector your mail is currently signed with, your DKIM is effectively switched off.
How does DKIM relate to DMARC?
DMARC requires a passing DKIM signature to be aligned: the d= domain in the signature must match the visible From domain (exactly in strict mode, or sharing the organizational domain in relaxed mode). A valid signature from an unrelated domain passes DKIM but does nothing for DMARC. Check your policy with our DMARC checker.
DKIM is one of three checks receivers run. Verify your SPF record and your DMARC policy too — or paste a sent message's headers into the email header analyzer to find your selector and see all three verdicts at once.