DKIM Record Checker
Check a domain's DKIM signing record, which authenticates that an email actually came from who it claims.
| Selector | Record |
|---|
Tries common selectors: google, selector1, selector2, k1, default, mail, dkim. Enter your own if it's different.
Related: run a full DNS record lookup for the domain.
This check is sent via DNS-over-HTTPS to Cloudflare, with Google and NextDNS as fallbacks.
Learn about DKIM
What DKIM actually verifies
DKIM signs outgoing mail with a private key, and the sending domain publishes the matching public key as a DNS TXT record at a selector-specific subdomain. A receiving server uses that public key to check the signature, which confirms the message wasn't altered in transit and really was signed by whoever holds the private key.
Reading your results
You need both the domain and the selector to find the right DKIM record, since the selector is just a prefix the sending system chooses, like google._domainkey or s1._domainkey. If you don't know a domain's selector, the quickest way to find it is to check the DKIM-Signature header's s= field in a real email that domain sent, which the Email Header Analyzer can help with.
Common questions
My DKIM record looks fine, but mail still fails DKIM. Why? A few common causes: mail forwarding or mailing lists that modify the message and break the signature in the process, a mismatch between the key that's published and the one actually signing, or whitespace and line-ending changes introduced somewhere in transit.
Does DKIM alone stop spoofing? Not by itself. DKIM only proves a message wasn't altered and was signed by whoever holds the key. It's the combination of DKIM, SPF, and DMARC enforcement that actually blocks spoofed mail from reaching an inbox.
Can a domain have more than one DKIM selector? Yes, and it's common. A domain might use one selector for its regular mail provider and another for a marketing platform, each with its own key.