DKIM selector and record checker
Check a supplied selector and domain for a usable DKIM DNS record.
Your inputs
Your results
Ready when you areYour results will appear here.
How it works
Build selector._domainkey.domain, inspect a pasted DKIM public-key record, or query its TXT record. The version tag is optional; when present it must be first and exactly DKIM1. The default key type is RSA. An empty p value means a revoked key. Sources: https://datatracker.ietf.org/doc/html/rfc6376, https://www.rfc-editor.org/rfc/rfc8463.html and https://knowledge.workspace.google.com/admin/security/set-up-dkim.
A few things to know
Common-tag and base64 checker, not a complete RFC validator or cryptographic verification service. RSA ASN.1 structure, modulus strength and message signatures are not checked. No selector discovery or DNS changes. Live lookup uses the shared Google Public DNS helper with a six-second timeout; pasted mode makes no requests. DNS failures are inconclusive. International domains must be entered in punycode.
When to use this tool
A DKIM selector identifies the DNS public key associated with a message’s signing domain. This checker builds the lookup hostname and inspects either a pasted record or live TXT values. It checks common tags and public-key encoding, including the expected Ed25519 byte length. Use it to review a provider’s DNS instructions or diagnose an exact selector lookup; it does not cryptographically verify an email signature or discover every selector on a domain.
- Check a provider-supplied DKIM TXT value before adding it to DNS.
- Look up the selector and signing domain found in an original message.
- Identify an empty public-key value or basic tag and base64 mistakes.
How to use dkim selector and record checker
Find the domain and selector
Use d= from a DKIM-Signature header for the Sending domain and s= for the selector, or use your provider’s setup instructions. Enter hostnames rather than an email address or website URL.
Choose the inspection mode
Paste one TXT value for a local check, or select live DNS lookup. Quoted DNS chunks belonging to one value are joined. Live mode sends the constructed selector hostname to Google Public DNS.
Interpret the diagnostics
Review the full DNS host, key status, decoded bytes and tag warnings. Correct basic mistakes with your provider, then verify real signed messages using an appropriate authentication workflow. This tool does not publish or rotate keys.
Inspect an Ed25519 demonstration key
Inputs
Use paste mode, example.com, selector brisbane and the supplied v=DKIM1; k=ed25519; p=... demonstration value.
Result
The hostname is brisbane._domainkey.example.com. Basic checks pass and the public-key data decodes to 32 bytes, reported as Present; 32-byte Ed25519 value.
What it means
The value fits the supported tag and encoding checks. It does not prove that example.com publishes it or that any message was signed correctly. The built-in value demonstrates inspection rather than setting up your own private/public key pair.
Common mistakes to avoid
Using the visible From domain automatically
A message’s DKIM d= domain can differ from its From domain. Use the signing domain and selector from the relevant signature when investigating that key.
Confusing TXT chunks with separate records
A long value can be displayed as quoted chunks inside one TXT record. Multiple independent key records at the same selector are a different condition and trigger diagnostics.
Treating decoded byte count as RSA strength
This checker does not parse RSA ASN.1 structure or modulus length. The number of decoded bytes is not a statement about an RSA key’s security strength.
Frequently asked questions
Definitions, edge cases, and practical next steps for this tool. Search all tool FAQs ↗
What is a DKIM selector?
It is the label used with the signing domain to locate a key, producing selector._domainkey.domain. It lets a sender use distinct keys or rotate them. Obtain it from the message’s s= signature value or your provider, because this tool does not discover selectors.
How do I choose the sending domain?
For a message investigation, use the DKIM-Signature d= value associated with the selector you are checking. For setup, use the provider’s instructed signing domain. Do not enter a URL, path or email address; internationalized domains should use punycode here.
Does Passed basic checks verify the signature?
No. It checks the record’s supported common tags and base64 encoding. It does not reconstruct signed message content, verify its signature or prove domain ownership. A real message-verification workflow is required to establish whether a particular DKIM signature passes.
What does an empty p tag mean?
An empty p value marks a revoked key. The tool reports Revoked and explains that it cannot validate new signatures. Do not replace it with an arbitrary sample key; consult the sending provider’s rotation or recovery procedure for the correct current key.
Are RSA and Ed25519 records supported?
Both are recognized. RSA is the default when k is omitted, but ASN.1 structure and modulus strength are not checked. Ed25519 public-key data is checked for a 32-byte decoded value. Encoding validity alone does not verify an actual signature for either type.
Can I paste a record split into quoted strings?
Yes. Quoted DNS TXT chunks are joined into one value, and whitespace inside public-key data is accepted. Paste the full value without PEM headers. Distinguish a control panel’s chunk display from separate TXT records returned for the same selector.
Why does live lookup return no record?
Check the selector spelling, signing domain, DNS publication and provider instructions. The tool queries that exact hostname only. It does not try alternate selectors or decide which selector your mail service should use; a lookup failure is not evidence that all DKIM on the domain is absent.
Does finding a DKIM key guarantee inbox delivery?
No. The key record is only part of message authentication. Signing configuration, content integrity, alignment and receiver decisions remain separate. Live data can also be cached, and network failures are inconclusive. Use actual-message evidence when diagnosing sending behavior.
Explore the topic in the blog
Sources and method
Use the references below to check definitions and platform guidance. The model’s scope and limits are explained above. Read our editorial standards.