Free DKIM Record Checker

Verify your DKIM key and selector configuration. Check key size, type, and CNAME delegation.

Common selectors:

What is DKIM and why does it matter?

DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was actually sent by the domain it claims to be from and that it hasn't been modified in transit.

Each outgoing email is signed with a private key, and the corresponding public key is published in DNS. Receiving servers verify the signature to authenticate the message.

🔑

Public key in DNS

Your DKIM public key is stored as a TXT record in your DNS zone under selector._domainkey.domain.

🔒

Message integrity

DKIM ensures the email body and headers haven't been tampered with during delivery.

🔄

Key rotation

Regularly rotate DKIM keys (at least 2048 bits) to maintain security.

Frequently Asked Questions

DKIM (DomainKeys Identified Mail) is an email authentication method that uses cryptographic signatures to verify that an email was sent by the domain it claims to be from and hasn't been altered in transit.
A DKIM selector is a string used to locate the DKIM public key in DNS. The full lookup is selector._domainkey.domain. Common selectors include "default", "google", "selector1", "k1".
DKIM keys should be at least 2048 bits. 1024-bit keys are still functional but considered weak. Keys shorter than 1024 bits should be replaced immediately.
Check the DKIM-Signature header in any email sent from your domain. Look for the "s=" tag - that's your selector. Common: "google" (Google), "selector1" (Microsoft 365), "k1" (Mailchimp).
Many ESPs (Brevo, Mailchimp, SendGrid) use CNAME records to point your DKIM selector to their DNS. This is normal and allows the ESP to manage key rotation automatically.

Go beyond DKIM

DKIM is one part of email authentication. Check SPF, DMARC, TLS, blocklists, and more with a full audit.

Run free full audit

Other free tools

SPF Checker DMARC Checker BIMI Checker Blocklist Checker Header Analyzer