DKIM Lookup
Enter a domain and a DKIM selector to retrieve the public key record at selector._domainkey.domain, check the key type and length, and spot invalid keys.
- Runs on our servers
- Free to use
About this tool
DKIM lets a domain sign its outgoing mail; receivers fetch the public key from DNS at selector._domainkey.domain to verify the signature. The DKIM Lookup queries that TXT record from our servers, joins the quoted strings that dig splits long keys into, parses the tags (v, k, p, h, s, t, n), measures the RSA key length and reports problems such as a revoked (empty) key, testing mode, short keys or duplicate records, alongside the raw record and dig output.
Complete the e-mail authentication picture with the SPF Lookup, the DMARC Lookup and the BIMI Lookup.
How to use it — quick steps
- 01
Enter the domain or hostname
Type or paste the domain or hostname in the field above, for example example.com. Use Ctrl + V to paste.
- 02
Press "Check DKIM"
Press "Check DKIM" or Ctrl + Enter. The result appears below in a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
External lookups
The lookup runs from our infrastructure, so you see what the public internet sees without exposing your own IP address or network.
Fast and cached
Results come back in seconds; identical lookups are cached for a few minutes to keep the service fast and responsive for everyone.
Easy to reuse
Every result block can be copied with one click or downloaded as a text file, and tables can also be saved as CSV for your reports.
Frequently asked questions
Where do I find the selector?
In the DKIM-Signature header of a message sent by the domain: the s= tag is the selector and d= the signing domain. Common selectors are default, google, selector1 and selector2 (Microsoft 365), k1 (Mailchimp), s1 and s2 (SendGrid).
What key length should I use?
2048-bit RSA is the current recommendation; 1024-bit keys still work but are being phased out, and shorter keys are rejected by most receivers. Ed25519 keys are supported by some providers.
What does t=y mean?
Testing mode: receivers treat a failed signature as if the message were unsigned. Remove the flag once your signing setup is verified.
The record exists but mail still fails DKIM
The public key must match the private key the mail server signs with, the selector in the header must match, and the record must not have been split or modified by the DNS editor; the raw dig output shows exactly what is published.