Check DKIM records for your domain with our free DKIM lookup tool. Instantly validate cryptographic keys and improve email deliverability
A DKIM lookup fetches the public key a domain publishes for DomainKeys Identified Mail. A sending server signs each message with a private key; the receiving server looks up the matching public key in DNS and uses it to check that the message really came from the domain and wasn't altered. This tool retrieves that key record and shows the RSA key size.
DKIM-Signature header. The s= value is the selector and d= is the signing domain.selector._domainkey.domain, for example google._domainkey.example.com.Common default selectors: google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp and s1/s2 for SendGrid. Your provider's DKIM settings page shows the exact name.
A DKIM key record looks like v=DKIM1; k=rsa; p=MIIBIjANBgkqh…. Its tags:
| Tag | Meaning |
|---|---|
v=DKIM1 | Version. Optional, but if present it must come first. |
k= | Key type: rsa (the default) or ed25519. |
p= | The Base64-encoded public key. An empty p= means the key has been revoked. |
t= | Flags. t=y marks the domain as testing DKIM; t=s means signatures must use exactly the d= domain in their i= identity, not a subdomain of it. |
h= | Hash algorithms the key may be used with, e.g. sha256. |
s= | Service types; email or *. |
n= | Free-text notes for administrators. |
The badge shows the RSA key length. 2048-bit keys are the current recommendation; 1024-bit keys still verify but are considered weak, and keys shorter than 1024 bits are not accepted as valid.
s= value in a real message's DKIM-Signature header.selector._domainkey.example.com as the host creates selector._domainkey.example.com.example.com. Enter only selector._domainkey in that case.d= domain in the signature must match the From domain (alignment). A provider signing with its own domain doesn't help your DMARC result.A label that lets a domain publish several DKIM keys at once, one per selector, under selector._domainkey.domain. Each signed message names its selector in the s= tag, so receivers know which key to fetch.
Use 2048-bit unless your DNS provider can't store a TXT record that long. 1024-bit keys are the minimum receivers accept and are no longer recommended.
Yes, one per selector. Each service that sends mail for the domain normally uses its own selector and key, and rotating keys means publishing a new selector before retiring the old one.
Most email providers generate the key for you and tell you what to publish. If you run your own mail server, the DKIM generator creates a key pair and the matching TXT record in your browser.