DKIM check: is your DKIM selector published correctly?
How does this check work, and what does the result tell you?
Enter a domain and selector below and this free tool looks up that DKIM selector's TXT record, validates its syntax and public key with AdminKit's own code, and explains common selector-hint patterns by provider, since DKIM keys are published per selector rather than per domain and there is no standard way to discover one from DNS alone.
Part of the Email authentication cluster — more tools, guides and terms on email authentication.
AI explanation Run a check below, then sign in to ask AI to explain the result in plain language.
Not sure of your selector? Common provider hints
- Google Workspace: google
- Microsoft 365: selector1, selector2
- Mailchimp / Mandrill: k1, k2, k3
- SendGrid: s1, s2
- Amazon SES: a random string shown in the SES console, e.g. "xyz123"
- Zoho Mail: zoho or zmail
- Generic / unknown: default, dkim, mail
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up when this result changes? Talk to our team and we'll set it up for you.
How it works and limits
DKIM (DomainKeys Identified Mail) publishes a public key in DNS so receivers can verify a cryptographic signature a
mail server adds to outgoing messages, as defined in RFC 6376. This tool
fetches the TXT record at <selector>._domainkey.<your domain> and checks its syntax with AdminKit’s own code.
Why you need a selector
A domain can publish many DKIM keys at once — one per sending service, rotated over time — each under its own selector label. There is no standard DNS record that lists a domain’s active selectors, so the selector has to come from whoever configured mail sending (it is usually shown in that provider’s admin panel, or follows a predictable pattern per provider; see the hints in the form above).
Reading the result
A record’s tags, listed below, are registered in IANA’s DKIM-Signature Tag Specifications:
p=— the base64-encoded public key. Empty means the key has been deliberately revoked (used when rotating or retiring a selector) — mail signed with it will now fail verification.k=— the key algorithm, almost alwaysrsa.t=y— marks a selector as “testing,” which some receivers treat leniently.
See how to read a DKIM check result for what an empty p=, the k=
algorithm, and a t=y flag each actually mean for your mail.
Limits
- This validates the DNS-published key record, not whether a specific message’s signature actually verifies — that needs the raw message headers, which this tool never sees.
- No query is logged; see /legal/privacy/.
To format the DNS record from a public key you have generated with openssl, use AdminKit’s DKIM record generator.
See SPF, DKIM and DMARC explained for how DKIM fits together with the other two mail authentication records. If your record looks right but signing still fails, see DKIM selector and record mistakes that break signing for the common causes, and the glossary entry for DKIM. See best free DKIM record checkers for how this tool’s domain-plus-selector lookup compares to MxToolbox, DNSChecker, EasyDMARC, dmarcian and mail-tester’s own free checkers.
Frequently asked questions
What is a DKIM selector?
A selector is the label that identifies one specific key among the several a domain can publish at once: RFC 6376 subdivides "the key namespace ... using 'selectors'" (RFC 6376 §3.1), resolving to a DNS name such as selector._domainkey.example.com. Your mail provider assigns the selector value, usually shown in its admin panel.
Why does my DKIM check need a selector input?
Because DKIM publishes one key per selector, not per domain, and RFC 6376 defines no DNS record listing a domain's selectors (RFC 6376 §3.1 only defines the per-selector query itself) — the selector value has to come from whoever configured mail sending, which is why this tool asks for both the domain and the selector.
I found a DKIM record with an empty p= value — is that broken?
No — it's deliberately disabled, not broken: RFC 6376 states plainly that "an empty value means that this public key has been revoked" (RFC 6376 §3.6.1), which is expected when rotating to a new selector or retiring an old mail-sending service. Mail still signed with that selector will now fail verification, which is the intended effect of revoking it.
Does a valid DKIM record mean my outgoing mail is signed correctly?
No — this only validates the published key record in DNS, not whether any specific message's signature actually verifies against it. RFC 6376 treats those as two separate steps: publishing a key (§3, what this tool checks) and a receiver verifying one signed message against it (§6) — the second step depends on your mail server correctly signing with the matching private key, which this tool never sees.