Look up a DKIM selector, inspect the published RSA or Ed25519 public key, and understand missing records, revoked keys and DNS errors. No email signature is verified.
Selector-specific DNS lookup with public-key syntax checks and clear next steps.
Look up the public key at one selector. This checks DNS and key syntax, not whether a particular email was signed correctly.
Not checked yet. No conclusion about DKIM has been made.
After checking the key, use the DMARC policy checker to inspect the domain’s policy. Alignment still requires a real message’s signing domain and From address.
Review the separate sender-authorization record with the SPF record checker. SPF does not replace a DKIM signature.
Reference: DKIM key-record specification, RSA key requirements, and Ed25519 DKIM. Setup help: Google Workspace or Microsoft 365 DKIM.
Building a sending workflow? The cold email stack guide explains where sending, verification and reply handling fit.
Open a sent message’s original headers and find DKIM-Signature. Use d= for the signing domain and s= for the selector. For example, d=example.com and s=mail.2026 map to mail.2026._domainkey.example.com. The visible From domain may differ from d=. Google’s google and Microsoft’s selector1/selector2 are examples, not universal defaults.
The checker requests TXT at the exact selector hostname, including records reached through DNS aliases. It joins chunks within one TXT record, checks tag syntax and duplicate tags, decodes RSA/Ed25519 public-key data, and reports key size or restrictions. It does not scan other selectors, validate DNSSEC, trace alias chains, or verify a message signature.
No record? Confirm the selector and domain with your provider; other selectors can still work. DNS failure? Retry before changing records. Empty p=? That key is revoked. Malformed key? Copy the complete provider-generated TXT value without splitting it into separate records. A CNAME-based setup needs the provider’s exact target. After changes, allow DNS caches to expire and send a real test message.
The receiving system uses a published key to verify signed message content. Finding a usable key here does not show that your sender has the matching private key, signing is enabled, or a message passes DKIM or DMARC. Inspect the recipient’s trusted Authentication-Results for dkim=pass and the expected signing domain. DKIM alone does not guarantee inbox placement.
Not with this selector-specific lookup. Obtain s= from a sent message’s DKIM-Signature header or your provider settings. A blank or unknown selector is not a domain-wide DKIM failure.
Yes. Enter the signing domain separately, then paste selector._domainkey.example.com into the selector field. The hostname must match the entered domain. Multi-label selectors and a trailing DNS dot are supported.
The version tag is recommended but optional. When present, v=DKIM1 must be first. The p= tag is required; an empty p= means the key is revoked. Unknown extension tags are ignored, but duplicate tags are invalid.
RSA public keys are decoded, with keys below 1024 bits rejected and keys below the recommended 2048 bits flagged. Ed25519 public keys must decode to 32 bytes. These are public-key checks, not message signature verification.
The sender may be using another selector, signing may be disabled, the private key may not match, or signed content may have changed. Test through the actual sending service and inspect the receiving system’s authentication result.
Email deliverability test
Inspect public DNS and message text with clear next steps. Inbox placement and reputation are not measured.
Email spam checker
Review plain-text email with highlighted copy notes, unresolved tokens and practical next steps.
DMARC checker
Live TXT lookup with plain-English interpretation of p=none, quarantine, reject, rua, and pct.
SPF record checker
SPF syntax checks, duplicate-record detection and bounded recursive include/redirect inspection.
