Free DKIM Checker
DKIM cryptographically signs your outgoing mail so receiving servers can verify it wasn't tampered with. Enter a domain to check whether a working DKIM public key exists in its DNS.
How it works
DKIM keys live at a selector address like `selector._domainkey.yourdomain.com`.
We query several common selectors to find any published `v=DKIM1` public key and check it.
We show the record and whether it passes, warns (short key), or isn't found — plus what to do.
Common DKIM errors
- •No DKIM record found for any common selector — enable DKIM in your email provider.
- •Record found but missing the `v=DKIM1` version tag, so it's not a valid DKIM record.
- •Empty `p=` public key — the key has been revoked or stripped.
- •Key too short (under ~200 chars) — some providers won't trust higher-bit keys.
- •Selector isn't publicly discoverable, so known selectors can't find it — try your exact selector.
Frequently asked questions
What does a DKIM check actually test?
It checks whether a valid, non-empty DKIM public key is published at the expected selector DNS address. It doesn't verify a specific email's signature — that happens per-message — but no key means no DKIM at all.
My domain shows 'selector not found'. Is DKIM broken?
Not necessarily. DKIM selectors aren't publicly discoverable — many providers use a custom selector we can't guess. Enter your exact selector (from your ESP) for an accurate result. 'Unknown' just means we couldn't auto-detect one.
Is DKIM enough on its own?
DKIM proves your mail is genuine, but it sets no enforcement policy. You need DMARC to tell receiving servers what to do on failure — and SPF to authorize senders. Think of DKIM as one layer of three.
Keep this record healthy 24/7
A single check only tells you how your DKIM looks right now. Sign up for continuous monitoring and get alerted the moment your records change or break.
Start free monitoring