Record found
The selector resolves to a DKIM public-key record. Confirm live mail uses the same selector and signing domain.
Check your DKIM record
Verify that a DKIM selector publishes a usable public key for your sending domain.
- No account required
- Public DNS records only
- Clear remediation guidance
What is a DKIM record?
DKIM—DomainKeys Identified Mail—adds a cryptographic signature to outgoing email. The sending service signs selected message headers with a private key, while the matching public key is published in DNS. A receiving system uses that public key to confirm that the signed content was not altered after it left the authorized sender.
DKIM records are selector-specific. A provider might use selector1, google, k1 or another value, and publish the key at selector._domainkey.yourdomain.com. Selectors let organizations rotate keys and operate more than one sending platform without placing every key in the same DNS record.
A DNS record alone does not prove that live messages are being signed. It confirms that a receiver can discover a public key for the selector you supplied. A complete test should also inspect the DKIM-Signature header on a real message and confirm that the signing domain aligns with the visible From domain for DMARC.
How the checker works
- 01
Enter the domain
Use the domain that appears in the DKIM signing identity, normally your business domain.
- 02
Provide the selector
Find it in the provider’s DNS instructions or the s= value of a DKIM-Signature header.
- 03
Query the key
The checker reads selector._domainkey.domain as a public TXT record.
- 04
Review evidence
It reports whether a usable DKIM value was found and shows the returned DNS evidence.
How to read DKIM results
Record missing
The queried hostname returned no usable key. Check the selector, DNS hostname and whether the provider has finished generating the key.
Malformed value
A TXT value exists but does not look like a valid DKIM record. Recopy the provider value without smart quotes, line breaks or a duplicated hostname.
Lookup unavailable
The resolver did not complete the query. No failure is assumed; wait briefly and run the check again.
Common DKIM problems and fixes
Wrong selector
Selectors cannot be enumerated reliably from DNS. Read the provider’s setup screen or a delivered message header and enter the exact selector value.
Hostname entered twice
Many DNS dashboards automatically append the zone name. Confirm the final published name is selector._domainkey.example.com, not that name repeated twice.
TXT value was split incorrectly
DNS may safely split a long key into quoted fragments, but stray spaces or copied quotation marks can corrupt it. Prefer the provider’s copy control.
Old keys remain active
After rotation, verify new messages use the new selector before removing the old key. Keep the overlap long enough for delayed messages to be verified.
Frequently asked questions
Practical answers about this checker and the signal it evaluates.
Where do I find my DKIM selector?+
Check your email provider’s domain-authentication page. You can also inspect a delivered message’s DKIM-Signature header and look for the s= tag. The d= tag identifies the signing domain.
Can a domain have multiple DKIM records?+
Yes. Each selector has its own DNS name, which supports multiple providers and safe key rotation. A single selector should resolve predictably to the key expected by its sender.
Does DKIM encrypt email?+
No. DKIM authenticates signed message content; it does not hide the message. Transport encryption such as TLS protects supported connections while a message moves between systems.
Why does DKIM pass but DMARC fail?+
The DKIM signing domain may not align with the visible From domain, or another part of the message may invalidate the signature. Review the d= domain, selector and authentication-results header.