Free DKIM Checker
Check a DKIM record by domain and selector. We verify the v=DKIM1 tag,
public key, key type and test-mode flag — then explain any problem in plain English.
Not sure of your selector? Look at the d= and s=
values in the DKIM-Signature: header of an email you sent — s= is the selector.
Watch deliverability across every client domain — automatically
Get a weekly plain-English deliverability verdict for every domain on your plan — branded with your agency's logo to forward to each client. One flat price covers all of them.
What a DKIM record actually is
A DKIM record is a single DNS TXT entry published at <selector>._domainkey.<yourdomain>. It holds the public half of a signing key. When your mail server sends a message it signs the headers with the private half; the receiving server fetches this public key and checks the signature. If they match, the message genuinely came from a system you authorised — and it was not altered on the way.
The record is a set of tag=value pairs:
v=DKIM1— the version. It should come first.k=rsa(ored25519) — the key type.p=…— the public key itself, a long base64 string. This is the part that matters most.t=y— an optional test flag. While it is present, receivers are told to ignore DKIM failures.
How to find your selector
The selector tells receivers which key to fetch, so you can rotate keys without breaking old mail. You will not usually guess it — read it off a message you already sent. Open the raw source of that email, find the DKIM-Signature: header, and look at the s= value: that is your selector. Common ones are google, selector1/selector2 (Microsoft 365), k1, s1, mail and dkim, but your provider decides.
The problems this checker catches
- No record at that selector. Either the selector is wrong or the key was never published. Try the
s=value from a real message. - An empty p= value. A key published with nothing after
p=has been revoked. Publish a fresh key, or remove the record. - A short key. Keys under about 1024 bits are weak. Use 2048-bit RSA.
- Test mode left on.
t=yis useful while you confirm signing works, but if you leave it in place DKIM never actually protects you. Remove it once you have seen a pass.
DKIM is one of three
DKIM proves a message was signed; SPF proves it came from an authorised server; DMARC ties both to your visible From address and tells receivers what to do when they do not line up. You need all three. Check the other two with the SPF checker and the DMARC checker.
Common questions
What is a DKIM selector?
The label in <selector>._domainkey.<domain> that points at one specific public key, so you can run and rotate several keys at once.
Why is my p= value empty?
An empty public key means the key has been revoked. Publish a fresh key from your email provider, or remove the record.
Can I publish more than one DKIM key?
Yes. Each key lives under its own selector — that is how key rotation and multiple sending services work side by side.
Does DKIM alone stop spoofing?
No. A spoofer can send unsigned mail. Only DMARC, with alignment, tells receivers to reject messages that fail authentication.
A one-off check is a snapshot — DMARC needs watching
PlainDMARC monitors your domains continuously and sends a weekly plain-English verdict per domain — what passed, what failed, and what to fix.