Free DKIM Record Lookup — Verify DKIM Selectors & Public Keys

Features · Advantages · Benefits

Why verify your DKIM record?

A missing or broken DKIM signature means emails from your domain cannot be cryptographically verified — increasing the risk of spam filtering and spoofing.

Feature

Auto Selector Detection

Don't know your selector? We try 25+ common selectors automatically — Google, Mailgun, SendGrid, Postmark, and more — and show every active one found.

Advantage

Full Record Parsing

Breaks down every DKIM tag — key type, public key, testing mode, flags, service type — so you can verify each field is correct.

Benefit

Catch Revoked Keys

A DKIM record with an empty p= tag means the key has been revoked. We flag this immediately so you know all signed emails will fail verification.

Selector

The unique name that identifies which DKIM key to use. One domain can have multiple selectors — one per mail provider or key rotation.

Public Key (p=)

The RSA or Ed25519 public key published in DNS. Mail servers use this to verify the cryptographic signature on your outgoing emails.

k=rsa

Key type. RSA 2048-bit is the standard. Ed25519 is newer, shorter, and mathematically stronger but not universally supported yet.

t=y (testing)

Testing mode flag. When set, receiving servers should not apply policy actions on DKIM failures — useful during initial setup.

Verify DKIM Email Signature

Paste the full raw email (headers + body) below. We'll extract the DKIM-Signature, fetch the public key from DNS, and cryptographically verify the signature.

How to get the raw email: In Gmail → three-dot menu → "Show original". In Apple Mail → View → Message → Raw Source. In Outlook → File → Properties → Internet headers (headers only).

FAQ

Frequently asked questions

A selector is a label you choose when creating a DKIM key pair. It tells receiving servers which public key to look up in DNS. The record lives at selector._domainkey.yourdomain.com. One domain can have multiple selectors — useful for different mail providers or key rotation.

Check the email headers of a sent email — look for a DKIM-Signature header and find the s= tag. That value is your selector. Alternatively, use our auto-detect mode which tries 25+ common selectors automatically.

An empty p= tag (p=) means the DKIM key has been intentionally revoked. Any email signed with the corresponding private key will fail DKIM verification. This is the correct way to retire an old DKIM key.

RSA 2048-bit is the current standard and widely supported. 1024-bit is considered weak and should be rotated. 4096-bit is very secure but some DNS providers have TXT record length limits that can cause issues. Ed25519 is a modern alternative — shorter key, stronger security, but not yet supported by all mail servers.

DKIM Record Lookup