DKIM Check
Look up a DKIM public-key record for a domain and selector.
No results yet
Enter a host above and press Run to start the check.
About the DKIM Check
DKIM Check looks up a domain's DomainKeys Identified Mail public-key record for a given selector. The record lives at selector._domainkey.yourdomain as a TXT entry containing the public key that verifies cryptographic signatures on outbound mail. Confirming the published key matches your mail provider's selector ensures recipients can validate your DKIM signatures.
How to use
- Enter the domain and the DKIM selector used by your mail provider.
- Run the check to fetch the record at selector._domainkey.yourdomain.
- Verify the public key is present and matches your provider's configuration.
Why DKIM lookups fail even when the signature is fine
DKIM keys are published per selector, not per domain, which is the single biggest source of confusion when checking one. The record lives at `<selector>._domainkey.<domain>`, and you cannot discover the selector from DNS — it is chosen by whoever configured the sender and travels in the `s=` tag of the `DKIM-Signature` header on an actual message. If you do not know the selector, the fastest route is to open the raw source of a message the domain sent and read it there. Common defaults are worth trying: `google`, `selector1` and `selector2` for Microsoft 365, `k1` for Mailchimp, `mandrill`, `dkim`.
A domain routinely has several selectors live at once, and that is correct rather than a misconfiguration. Each sending service — your mail host, your invoicing platform, your marketing tool — publishes its own key, and rotating a key means standing up a new selector while the old one still validates mail already in flight.
The most common real failure is not the key at all but the body hash. `bh=` covers the message body, and any system that modifies content in transit — a mailing list appending a footer, a security appliance rewriting links — invalidates it while leaving the header signature intact. The error reads `body hash did not verify`, and it points at something in the delivery path, not at your DNS record.
Frequently asked questions
- What is a DKIM selector?
- A selector is a label that identifies which DKIM key to use, allowing a domain to publish multiple keys. It forms part of the record name, as in selector._domainkey.example.com.
- How do I find my DKIM selector?
- The selector appears in the DKIM-Signature header of your outbound email under the s= tag, and is also documented by your mail provider.
- What does the DKIM record contain?
- It holds the public key paired with the private key your mail server uses to sign messages. Receivers use it to verify the signature's authenticity.