Enter a domain and its DKIM selector to fetch the public key from DNS, or leave the selector empty to try more than 45 common ones. The tool decodes the key to show its type and real bit length, explains every tag and flags weak, revoked or broken records.
Last updated:
Or check a DKIM record you paste (no lookup)
Enter a domain and selector, then click Check DKIM record to see the public key, its type and bit length, and every tag explained.
Advertisement
Advertisement
How to use the DKIM Record Checker
Enter the domain from the email's From address, for example example.com.
Enter the selector (the s= value in a DKIM-Signature header), or leave it empty to try common selectors.
Click Check DKIM record.
Read the key summary: key type, bit length, testing flag and record length.
Review the notes and tag table, fix any problems at your DNS host, or paste a draft record to check it before publishing.
DKIM record tags at a glance
Tag
Required
Values
What it does
v
Recommended
DKIM1
Version; if present it must be the first tag
k
No
rsa (default), ed25519
Key algorithm
p
Yes
base64 key, or empty
The public key; empty means revoked
h
No
sha256
Hash algorithms allowed for signatures
t
No
y, s
Testing mode, or strict domain matching
s
No
*, email
Service the key may be used for
n
No
text
Notes for humans
Selectors used by common email services
Service
Selector(s)
How the key is published
Google Workspace
google (default, can be changed)
TXT record you copy from the Admin console
Microsoft 365
selector1, selector2
CNAMEs to keys hosted in your onmicrosoft.com tenant, rotated by Microsoft
SendGrid
s1, s2
CNAMEs to SendGrid-hosted keys
Mailchimp
k2, k3
CNAMEs to dkim.mcsv.net
Fastmail
fm1, fm2, fm3
CNAMEs to Fastmail
Proton Mail
protonmail, protonmail2, protonmail3
CNAMEs to Proton
Amazon SES
three random tokens
CNAMEs shown in the SES console (not guessable)
Tips for a healthy DKIM setup
Use 2048-bit RSA keys and rotate them about once or twice a year by publishing a new selector, switching signing to it, then revoking the old one.
Remove t=y once your signatures verify; testing mode can lead receivers to ignore failures.
Check alignment. For DMARC to pass on DKIM, the d= domain in the signature must match the From domain. Review your policy with the DMARC Checker and your sending servers with the SPF Record Checker.
Need a new key? The DKIM Record Generator creates a key pair and the matching DNS record in your browser.
Frequently asked questions
What is a DKIM record?
DKIM (DomainKeys Identified Mail, RFC 6376) lets a domain sign its outgoing email with a private key. The matching public key is published as a TXT record at selector._domainkey.yourdomain. Receiving servers fetch that key, verify the signature and know the message really came from the domain and was not altered.
How do I find my DKIM selector?
Open an email sent from the domain and view its original source or headers. In the DKIM-Signature header, the s= tag is the selector and d= is the signing domain. Your email provider's admin console also shows it, for example google for Google Workspace or selector1 and selector2 for Microsoft 365.
Why can't the checker find my DKIM record without a selector?
DNS has no way to list all selectors of a domain, so a checker can only guess. This tool tries more than 45 common names, but providers such as Amazon SES, Postmark or many marketing platforms use random or dated selectors. Enter the exact selector from a message header to check those.
Is a 1024-bit DKIM key still safe?
It still verifies, but it is considered weak. RFC 8301 requires verifiers to accept keys from 1024 bits, and recommends signers use at least 2048-bit RSA keys. Gmail and other large receivers recommend 2048 bits. Keys shorter than 1024 bits must be rejected.
What does an empty p= mean?
An empty public key value means the key has been revoked. Signatures made with that selector will fail. Domains do this on purpose when they retire a selector after key rotation, so that old signatures can no longer be trusted.
Why is my 2048-bit key split into several strings?
A single string inside a DNS TXT record can hold at most 255 characters, and a 2048-bit key record is about 410 characters. It is therefore stored as two or more quoted strings that verifiers join together. Most DNS dashboards split it automatically; the checker joins the parts before analyzing them.
Is this check private?
The lookup goes directly from your browser to Cloudflare's or Google's public DNS-over-HTTPS resolver, and pasted records are analyzed entirely in your browser. FreeToolCabin does not receive or store anything.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.