Free DKIM record checker
Enter a domain and a DKIM selector. The checker looks up the TXT record at selector._domainkey.domain and reads the public key. You can also try a short list of common selectors.
Free, no signup. Every row comes from a DNS answer for the name that was queried.
The lookup runs on the Uno Directory server. It asks DNS for a TXT record at selector._domainkey.domain. It does not send mail, and it does not open a URL.
Type a domain such as example.com. The checker does not take a URL.
Enter the selector, or leave it blank and use the common-selector box. The names in that list are google, selector1, selector2, k1, default, s1, s2, mail, dkim.
Click Check DKIM. Each row is one TXT lookup. Pass, warn, and fail describe that selector only.
Pass. One TXT record, a readable key, and none of the flags below.
Warn. The key is revoked, the RSA key is under 1024 bits, t=y is set, more than one TXT record was returned, or the text is not a usable DKIM key.
Fail. No TXT record was published, or the lookup timed out or failed. A failed lookup is not treated as a missing record.
Flags. No record, key revoked (empty p=), multiple TXT records, key under 1024 bits, and test mode (t=y). Each flag has its own explanation.
How to read a DKIM check
A DKIM public key is not stored on the domain itself. It is a TXT record at the selector, then ._domainkey, then the domain. For the names in RFC 6376, d=example.com and s=foo.bar, the query is foo.bar._domainkey.example.com. The selector is chosen by the mail system. A lookup of the domain cannot list it. On a message, the selector is the s= tag in DKIM-Signature, and the domain is the d= tag.
The record is a list of tags. v= is the version and defaults to DKIM1. If v= is present it has to be first, and the value has to be exactly DKIM1. k= is the key type and defaults to rsa. p= is the public key. An empty p= revokes the selector. h= lists the hash algorithms the key will accept, and it defaults to allowing all of them. s= is the service type and defaults to *. t= holds flags. y means the domain is testing DKIM. This page shows those six tags, including when a tag is absent, and it measures an RSA key from the modulus inside p=.
Google Workspace uses google as its default selector. Microsoft 365 publishes selector1 and selector2, usually as CNAMEs. Those names are in the common list, with k1, default, s1, s2, mail, and dkim. The list is not every selector a domain might use. If a name you care about is missing, enter it.
A published key does not prove that a particular message passed. That depends on the DKIM-Signature header, which a DNS lookup cannot see. This page also does not send mail. Two TXT records at one selector are both shown. Their tags are not merged. The TXT record for a selector is supposed to be unique, and if the set has more than one record the results are undefined.
DKIM is one of three DNS checks receivers use. The SPF record generator builds the TXT record that lists who may send for the domain. The DMARC record generator builds the _dmarc policy for mail that fails SPF or DKIM alignment. The email DNS checker reads MX, SPF, DMARC, and one DKIM selector together. The tag rules on this page are from RFC 6376.
Questions
Submit a tool to Uno Directory
Built a product founders should be able to find? List it on Uno Directory. A free listing needs a backlink badge. A paid listing goes live without one.
Submit a tool