DKIM check: is your DKIM selector published correctly?
Looks up a DKIM selector's TXT record, validates its syntax and public key, and explains common selector-hint patterns by provider, since DKIM keys are published per selector rather than per domain and there is no standard way to discover one from DNS alone.
Not sure of your selector? Common provider hints
- Google Workspace: google
- Microsoft 365: selector1, selector2
- Mailchimp / Mandrill: k1, k2, k3
- SendGrid: s1, s2
- Amazon SES: a random string shown in the SES console, e.g. "xyz123"
- Zoho Mail: zoho or zmail
- Generic / unknown: default, dkim, mail
How it works and limits
DKIM (DomainKeys Identified Mail) publishes a public key in DNS so receivers can verify a cryptographic signature a
mail server adds to outgoing messages. This tool fetches the TXT record at <selector>._domainkey.<your domain> and
checks its syntax with AdminKit’s own code.
Why you need a selector
A domain can publish many DKIM keys at once — one per sending service, rotated over time — each under its own selector label. There is no standard DNS record that lists a domain’s active selectors, so the selector has to come from whoever configured mail sending (it is usually shown in that provider’s admin panel, or follows a predictable pattern per provider; see the hints in the form above).
Reading the result
A valid record has a p= tag containing a base64-encoded public key. An empty p= means the key has been
deliberately revoked (used when rotating or retiring a selector) — mail signed with it will now fail verification.
k= names the key algorithm (almost always rsa); t=y marks a selector as “testing,” which some receivers treat
leniently.
Limits
- This validates the DNS-published key record, not whether a specific message’s signature actually verifies — that needs the raw message headers, which this tool never sees.
- No query is logged; see /legal/privacy/.
Frequently asked questions
What is a DKIM selector?
The selector is the label in front of _domainkey in the DNS name (selector._domainkey.example.com); your mail provider assigns it.
Why does my DKIM check need a selector input?
DKIM keys are published per selector, not per domain, and there is no standard way to discover a domain's selector from DNS alone.