Prontuno
Pricing
AI

Appearance

Log in Request access
Tools

ToolsEmail authentication

Free DKIM checker and public key lookup

A DKIM record publishes a public key in DNS that receivers use to verify that a message was signed by your domain. Enter a domain and selector below to check the key.

Background

What is a DKIM record?

A DKIM record is a DNS TXT record that publishes the public key for DomainKeys Identified Mail. The sending server signs each message with a private key, and the receiving server fetches the matching public key from selector._domainkey.example.com to confirm the message came from the domain and was not changed in transit.

How to read the result

A valid result confirms that a public key is published at the selector you entered. It does not prove that every message from the domain is signed.

To confirm a specific message, compare the selector with the s= value in its DKIM-Signature header, then check the Authentication-Results header to see whether verification passed.

Coverage

What this tool checks

  • The TXT record at selector._domainkey.example.com
  • The DKIM version and key type, such as RSA or Ed25519
  • The public key size, with a warning for RSA keys under 2048 bits
  • Whether the key is revoked with an empty p= tag
  • Testing mode (t=y) and the allowed hash algorithms

Step by step

How to find your DKIM selector

  1. Open a recent message sent from the domain.

  2. Open its raw headers: Show original in Gmail, View message source in Outlook, or View → Message → All Headers in Apple Mail.

  3. Find the DKIM-Signature header. Its d= value is the signing domain and its s= value is the selector.

  4. Enter that domain and selector in the form above, then select Check DKIM.

Reference

DKIM record tags

Tag Meaning Default
v=DKIM1 Record version. If present, it must come first. None
k= Key type: rsa or ed25519. rsa
p= The public key, Base64 encoded. An empty value revokes the key. Required
t= Flags. y marks testing mode and s blocks use by subdomains. None
h= Hash algorithms the key may be used with, such as sha256. All
s= Service types the key applies to. *

Troubleshooting

Common problems and how to fix them

No record found
Confirm the selector. Each sending service chooses its own selector, and it is rarely named default. Find it in the DKIM-Signature header of a recent message or on the service’s domain setup page.
Key is revoked
An empty p= value revokes the key. Publish the current key from your sending service, or switch the service to a selector that has an active key.
Invalid syntax
Compare the record with the value your sending service supplied. Remove extra quotes, spaces, or duplicate tags added when the value was pasted into DNS.
Weak key
RSA keys shorter than 2048 bits are considered weak. Generate a new key with your sending service and publish it under a new selector. Keep the old selector until messages signed with it are no longer in transit.

Example

Selector:     pm1
Record name:  pm1._domainkey.example.com
Record value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…
A valid record includes v=DKIM1, a supported key type, and a public key in the p= tag.

FAQ

Questions about DKIM

What is a DKIM selector?
A selector tells receivers which public key to use when verifying a message. It appears as the s= value in the DKIM-Signature header and forms the first part of the DNS record name.
Can a domain have more than one DKIM selector?
Yes. Each sending service usually has its own selector, and selectors let you rotate keys without interrupting verification.
Does a valid key mean DKIM will pass?
No. The message must also be signed with the matching private key and must not change after signing. Forwarding services and mailing lists sometimes modify messages, which breaks the signature.

Keep checking

Related tools

  • Free SPF checker

    Validate a domain’s SPF policy, inspect mechanisms, and count DNS lookups.

  • Free DMARC checker

    Review a domain’s DMARC policy, alignment, reporting addresses, and enforcement.

  • Email header analyzer

    Inspect SPF, DKIM, and DMARC results, identify the sending IP, confirm reverse DNS, and trace the delivery path.

Sending with Prontuno?

Domain authentication

Set up SPF, DKIM, and DMARC.

About Domain authentication
Specifications
RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (opens in a new tab)
RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM (opens in a new tab)
RFC 8463: A New Cryptographic Signature Method for DKIM (opens in a new tab)