Menu
Fix deliverability Security Pricing
Theme
Free tool

DKIM check.

Verify a DKIM selector is published for a domain by looking up the TXT record at <selector>._domainkey.<domain>.

No signup. No spam.
Domain
Selector
Tip: look in email headers for DKIM-Signature → s=.

What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method that lets the receiving mail server verify that an email was actually sent and authorized by the owner of the sending domain. It works by attaching a digital signature to every outgoing message.

How DKIM signing works
Your mail server signs outgoing messages with a private key. The corresponding public key is published as a DNS TXT record at <selector>._domainkey.yourdomain.com. Receivers look up the public key and verify the signature.
Why selectors matter
Each sending service (Google Workspace, SendGrid, Mailchimp, etc.) uses its own selector. This lets you have multiple DKIM keys for different mail streams. Common selectors include google, s1, s2, k1, and selector1.
What pass/fail means
A DKIM pass means the signature is valid and the message wasn't tampered with in transit. A fail means the signature couldn't be verified — the key may be missing, rotated, or the message was altered. DKIM failures hurt DMARC alignment.

Common DKIM failure causes

Issue
Severity
Fix
Selector not published in DNS
High
Add the TXT record provided by your email service (e.g., Google, SendGrid)
Key rotated but old key removed
High
Keep old selectors active during rotation windows (7-14 days overlap)
Message modified in transit (mailing list, forwarder)
Medium
Expected behavior for some forwarding. Ensure DMARC uses relaxed alignment
Wrong domain in d= tag
Medium
Ensure d= matches your From domain (or a parent domain for relaxed alignment)
1024-bit key (weak)
Low
Upgrade to 2048-bit keys when your provider supports it

How to check DKIM manually

To look up a DKIM record, you need to know the selector. Check your email headers for the DKIM-Signature header — the s= tag contains the selector.

Example DNS lookup
dig TXT google._domainkey.example.com +short

Replace google with your selector and example.com with your domain.

Related tools
Want continuous monitoring?
DNS Doctors monitors your DKIM selectors, detects key rotations, and alerts you when signatures break.
Learn more