DKIM record

DKIM Checker

Check whether your domain has a valid DKIM record. DKIM signs your outgoing mail so receivers can confirm it really came from you and wasn't altered.

One record is only part of it

MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC and BIMI all decide together whether your mail is trusted. The full report reads every one of them and hands you the fix.

Run the full domain check

About these results

This tool reads your domain's public DKIM (TXT) records at the moment of the check. DKIM records live under a selector that is unique to each provider, so we probe common selectors and any selector you enter - a "not found" result does not always mean DKIM is missing. Results reflect current public DNS and can be affected by caching and propagation (up to 24-48 hours). Guidance is general and not a substitute for your provider's official instructions. We don't store the domains you check.

Reference

How DKIM works

What the record is for, how to read the result, and what to do about each problem.

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. Your provider signs with a private key and publishes the matching public key in DNS. Receivers verify the signature - proving the message really came from your domain and wasn't changed in transit.

How DKIM works

The public key lives at <selector>._domainkey.yourdomain. The selector is chosen by your provider, so a DKIM record can't be discovered without it.

Common problems and fixes

No DKIM found: open a sent email, view headers, read the s= value in DKIM-Signature:, and enter that selector. If you have none, enable DKIM in your provider and publish the key.
Revoked key: the record exists but p= is empty - re-publish the public key.

Questions

Frequently asked

What is a DKIM selector?

A selector is a short name your email provider chooses (like google, selector1, or s1). Your public DKIM key is published at selector._domainkey.yourdomain, so a DKIM record cannot be found without knowing the selector. You can read it from the s= tag in a message's DKIM-Signature header.

Why was my DKIM not found?

We probe common selectors and any selector you enter. If none match, your provider may use a different selector, or DKIM may not be set up. Find your selector in a sent message's DKIM-Signature header, then check again.

Do I need DKIM if I already have SPF?

Yes. DKIM survives message forwarding better than SPF, and DMARC needs SPF or DKIM to pass with alignment. Using both gives the strongest authentication.

Related checks