DKIM checker
Look up and validate a domain's DKIM keys. Enter a selector if you know it, or leave it empty and we'll try the common ones.
Related tools: MX lookup · SPF checker · DMARC checker · All free tools
The public key receivers verify your mail with
DKIM signs outgoing mail with a private key, and publishes the matching public key in DNS so receivers can check the signature. The key lives in a TXT record at selector._domainkey.example.com, where the selector is a name the sending service chose. This tool fetches that record from Cloudflare's 1.1.1.1 resolver, reads the key type and length, and checks the tags that break or weaken signing. Without a selector it tries 32 common ones, including Google Workspace's and Microsoft 365's.
DKIM records get removed during DNS migrations and rotated by providers. Upcheck's DNS check watches the records that take a site down, and re-resolves every website every 6 hours, MX records included.
Three steps, no signup
- 01
Enter a domain
The domain in the From address of the mail you send. Add the selector if you know it.
- 02
We fetch the key
The TXT record at selector._domainkey is read from a public resolver; without a selector, common selectors are tried in parallel.
- 03
Each key is validated
Key type and length are decoded, and every tag that affects signing is checked and explained.
Frequently asked questions
What is a DKIM record?
DomainKeys Identified Mail: a TXT record holding the public half of the key your mail server signs messages with. A receiving server reads the DKIM-Signature header on a message, looks up the public key at the selector and domain it names, and checks that the signature matches. A valid signature proves the message came from someone holding the domain's private key and wasn't altered on the way.
How do I find my DKIM selector?
Open a message you sent from the domain, view its original source or headers, and find the DKIM-Signature header. The s= value is the selector and d= is the domain. Your mail provider's DKIM setup page shows it too: Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2, and most marketing platforms use their own names.
Why doesn't the checker find my DKIM key?
Usually because the selector is one the checker didn't try. Many services use selectors unique to your account, which can't be guessed; enter yours from the DKIM-Signature header. If you did enter the right selector, the record may not be published yet, may be at the wrong name (the host field often gets the domain appended twice), or DKIM signing may never have been switched on at the provider.
Is a 1024-bit DKIM key still OK?
It works: RFC 8301 sets 1024 bits as the minimum receivers must accept. But 2048 bits is the recommendation and what most providers now issue, because 1024-bit RSA is within reach of well-resourced attackers. Keys shorter than 1024 bits are ignored by major receivers, so mail signed with them is treated as unsigned.
What does an empty p= mean?
That the key has been revoked. Publishing the record with an empty p= tag is the standard way to retire a key while making it clear to receivers that signatures with it must fail. If mail is still being signed with that selector, it will fail DKIM until the sender switches to the current key.
Do I need DKIM if I already have SPF?
Yes. SPF breaks when mail is forwarded, because the forwarding server isn't in your SPF record; a DKIM signature survives forwarding. DMARC passes if either aligns, so having both is what keeps legitimate mail passing in the cases where one of them fails. Check the other two with the SPF checker and the DMARC checker.
One check validates the key. Monitoring watches the zone it lives in.
Add your domains to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook when the records that matter change.