- DKIM lookup with common selectors built in
- Multi-part records merged
- Email the report
DKIM Record Checker
Use LeadCanal's DKIM Record Checker to verify your domain's email authentication and prevent spoofing, phishing, and spam. Get complete DKIM records with full public key display.
Enter a domain name and click "Check DKIM Record" to see complete DKIM analysis.
💡 The default selector "default" will be used automatically unless you enable custom selector.
Enter your domain and DKIM selector and the DKIM checker finds the public key, merges multi-part records and validates every tag. Not sure of your selector? Pick from the common ones.
How to check a DKIM record
You need the domain and the selector your email provider signs with.
- 1
Enter your domain
Use the domain in your From address, such as example.com.
- 2
Add the DKIM selector
Find it in the DKIM-Signature header of an email you sent (the s= value), or pick a common one such as google, selector1 or k1.
- 3
Run the DKIM lookup
The checker queries selector._domainkey.yourdomain, joins split records and checks the key and every tag.
- 4
Fix and send a test
Publish the corrected record, then send a test email and confirm the header shows dkim=pass.
Find your DKIM selector
A DKIM lookup needs the selector as well as the domain. These are the defaults for the most common platforms.
| Platform | Usual selector | Where to confirm it |
|---|---|---|
| Google Workspace | Admin console, Apps, Gmail, Authenticate email | |
| Microsoft 365 | selector1, selector2 | Defender portal, Email authentication, DKIM |
| Mailchimp | k1 | Domains settings in your account |
| SendGrid | s1, s2 | Sender authentication settings |
| Amazon SES | Random string per domain | Verified identities, DKIM tab |
| Any sent email | The s= tag | Open the original message and read the DKIM-Signature header |
How DKIM works
Your mail server signs each outgoing message with a private key. The matching public key sits in DNS at selector._domainkey.yourdomain.com.
The receiving server reads the selector from the message header, fetches the public key and checks the signature. If the message was changed in transit, or the key is wrong, DKIM fails.
- v=DKIM1 marks the record version
- k=rsa names the key type
- p= holds the public key itself
- An empty p= means the key was revoked
Common problems the DKIM checker finds
If a DKIM record checker reports a failure, it is usually one of these.
Wrong selector
The record exists under a different selector. Check the s= tag in a real sent email.
Record not published
DKIM was generated in your email platform but never added to DNS, or signing was never turned on.
Broken long key
A 2048-bit key split badly across strings, or with stray quotes or spaces, will not parse.
Key mismatch
The key in DNS is old and the server signs with a new one. Republish the current key.
CNAME not resolving
Some platforms use a CNAME to their own key. A typo in the target breaks the lookup.
1024-bit key
Still works, but 2048-bit is the current recommendation where your DNS allows it.
Why DKIM matters more than ever
Since February 2024, Gmail and Yahoo require DKIM signing from anyone sending more than 5,000 messages a day, alongside SPF and DMARC. Even low-volume senders see better placement when DKIM passes.
DKIM also survives forwarding, where SPF breaks. That makes it the record most likely to carry your DMARC pass when a reader's company routes mail through another server.
Enter your domain, choose a selector from the list or type your own, and run the check. The tool fetches the DKIM record, validates it and lets you email the report.
A selector is a label that tells receivers where to find your public key. It lets one domain hold several DKIM keys, one per sending service. You will find it in the s= tag of a signed email.
Usually the selector is wrong, or the record was never published. Confirm the selector from a real email header, then check your DNS for a TXT or CNAME record at selector._domainkey.
Yes. Each sending service should use its own selector, so a domain can hold several DKIM records at once. That is different from SPF, which allows only one record.
Usually minutes to a few hours, depending on TTL. Some platforms also need you to switch signing on after the record is live. Run the DKIM record checker again to confirm.
Further reading
- RFC 6376: DomainKeys Identified Mail The DKIM standard that defines signatures, selectors and key tags.
- RFC 7489: DMARC The DMARC specification, covering policies, alignment and reports.
- Google email sender guidelines Gmail requirements for authentication, spam rates and unsubscribe links.
DKIM still failing after the fix?
Send us the domain. We find the cause, publish the right keys and confirm SPF, DKIM and DMARC all pass.