DKIM Record Checker

Check whether a domain publishes a DKIM public-key TXT record at selector._domainkey.domain using Google DNS-over-HTTPS. Enter the selector from a signed email header for the most reliable check, or leave it blank to probe the tool's built-in list of common selectors until the first match is found. Results show the matched selector, key type, record text, selectors tried, and warnings for a missing v=DKIM1 tag or an empty revoked key. This is a DNS publication and basic structure check; it does not verify an email signature, test every possible selector, or assess private keys.

How to Use the DKIM Record Checker

Check a known DKIM selector, or let the tool probe its built-in common-selector list for the first public key it can find.

  1. Enter the signing domain shown in the email's DKIM-Signature header.
  2. Enter the s= selector when you know it; leave Selector blank only for a best-effort common-selector search.
  3. Select Run to query selector._domainkey.domain through Google DNS-over-HTTPS.
  4. Review the matched selector, key type, full record, number tried, and any malformed or revoked-key warning.
  5. Confirm real delivery by sending a message and checking its authentication result; this page does not verify a signature.

How the check works

With a supplied selector, the checker requests one TXT hostname. With a blank selector, it tests a fixed list in sequence and stops on the first DKIM-like record.

The parser recognizes public-key data, expects v=DKIM1, defaults an omitted key type to RSA for display, and warns when p= is empty.

Interpreting results

  • Found means a DKIM-like public TXT record was returned; it does not prove a particular email signature passes.
  • Malformed means the returned key-like value lacks the expected v=DKIM1 tag.
  • An empty p= value indicates a revoked selector rather than a usable public key.

Common mistakes

  • Guessing a provider name instead of copying s= from an actual DKIM-Signature header.
  • Concluding DKIM is absent because none of the built-in common selectors matched.
  • Checking the visible From domain when the DKIM d= signing domain is different.

Limitations and privacy

Selectors are not enumerable, the checker stops at the first common-selector match, and its structural checks do not validate key strength, signatures, alignment, or mail delivery.

Queries go from your browser to Google DNS-over-HTTPS. Only public keys are retrieved; private DKIM keys and email content are never requested.

FAQ

What is a DKIM selector?

A selector identifies which public key signed a message. For selector s1 and domain example.com, the tool queries s1._domainkey.example.com.

Where can I find the correct selector?

Inspect a signed message's DKIM-Signature header and use the value after s=. Your email provider's DNS setup instructions may also name the selector.

What happens if I leave the selector blank?

The checker tries a built-in sequence of common selectors and stops at the first matching DKIM-like TXT record. It reports how many selectors were tried.

Does no result mean the domain has no DKIM?

Not necessarily. Selectors are chosen by the sender and cannot be discovered exhaustively from DNS. Enter the selector from an actual message before concluding that no key exists.

What does a missing v=DKIM1 warning mean?

The tool found a TXT value containing DKIM-like key data but not the expected v=DKIM1 prefix, so it marks the record as malformed. Compare the full value with your provider's required record.

What does an empty p= value mean?

An empty public-key value indicates a revoked selector. Mail signed with that selector should no longer validate, so active senders need a different published key.

Does the checker validate a DKIM signature?

No. It does not accept or parse an email message. It checks public DNS publication and a few structural signals only.

Can this tool access my DKIM private key?

No. DKIM private keys stay on the sending mail system. The checker retrieves only the public TXT record exposed in DNS.

Which resolver performs the lookup?

The checker queries Google DNS-over-HTTPS. Resolver caching means a recently rotated key may not appear until the old TTL has expired.

What should I do after changing a DKIM record?

Wait for DNS caches to expire, check the exact selector again, then send a test message and inspect authentication results with a mail system that can verify the actual signature.