Free Tool

Free DKIM Record Checker

Query any domain and selector to see the DKIM public key, key type, and policy tags. Click a common selector to try it instantly.

Common selectors:

How it works

01

Enter domain + selector

DKIM lives at <selector>._domainkey.<domain> — you need both pieces.

02

We query the TXT record

And parse the canonical DKIM tags (v, k, p, t, s, h, n).

03

Read the verdict

Empty p= means the selector was revoked. t=y means test mode. Everything else is shown verbatim.

Frequently asked questions

Where do I find my selector?+

Look in the DKIM-Signature header of any email sent from the domain — the 's=' tag is the selector. Google Workspace uses 'google' by default; Mailgun uses 'k1'; ESPs typically use 'selector1'/'selector2'.

Why is my DKIM record so long?+

DKIM TXT records can be split into multiple quoted strings by DNS providers because TXT chunks max at 255 bytes. The receiving side concatenates them. We do the same here, so what you see is the full record.

What's a good DKIM key size?+

2048-bit RSA is standard in 2026. 1024 still works but is considered weak. ed25519 is newer and supported by major receivers; it's smaller and faster but adoption is mixed.

I revoked a key — why is it still being trusted?+

Revoking means setting p= to empty. Receivers cache DKIM records based on TXT TTL, so revocations take up to the TTL window to be honored.

Building a SaaS that needs custom domains?

Domainee is the API for adding customer custom domains to your product. One CNAME, automatic TLS, no DevOps to staff.

50 custom domains and 100 GB bandwidth free, forever.

More free tools