DKIM Record Checker

Look up a DKIM public-key record for any domain and selector and confirm it is published and well-formed. The checker queries the selector._domainkey hostname, verifies a v=DKIM1 key with a p= public key exists, shows the key type, and warns when the key is empty, which is the convention for a revoked selector. Live and private in your browser.

Enter a domain and its DKIM selector. The selector is the label your mail provider puts before ._domainkey (for example default or google).

How it works

  1. 1

    Enter the domain

    Type the domain that signs the mail, such as example.com.

  2. 2

    Add the selector

    Enter the DKIM selector, the label your mail provider puts before ._domainkey, for example default, google or a dated string like 20230601.

  3. 3

    Run the check

    Press Check DKIM. The tool fetches the selector record over secure DNS and reports the key type and whether it is valid or revoked.

Instant & 100% private — nothing is uploaded

Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.

Frequently asked questions

What is a DKIM selector?
A selector is a label that lets a domain publish more than one DKIM key at once. The public key lives at selector._domainkey.yourdomain.com, and each signed message names the selector it used in its DKIM header. Selectors differ by provider — common examples are default, google, k1, s1 or a dated value — so you need the right one to find the record.
What does an empty p= tag mean?
The p= tag holds the base64 public key. When it is present but empty (p=), the record marks the key as revoked. Mail signed with that selector will fail DKIM, which is exactly what you want after you have rotated to a new key and retired the old one.
Why can I not find a DKIM record?
The most common reason is the wrong selector — DKIM only exists for selectors your mail server actually uses, and there is no way to list them from DNS. Check your provider documentation or a recent signed message header for the correct selector, then try again.
Does the checker see my private key?
No. DKIM private keys never appear in DNS; only the public key is published. The checker reads that public record over a secure connection from your browser and keeps no log of what you looked up.

More tools

JSON Formatter & ValidatorBeautify, minify, validate JSON with a collapsible tree view.Code Formatter & MinifierPretty-print or minify JS, TS, CSS, HTML, JSON, SQL and more.YAML ⇄ JSON ⇄ TOML ConverterConvert config between YAML, JSON and TOML, both ways.JSON Schema Viewer & ValidatorRender a JSON Schema as a tree and validate data against it.Markdown Editor (Live Preview)Write Markdown with a live, side-by-side HTML preview.Mermaid Live EditorTurn Mermaid text into flowcharts and diagrams, live.

More from the Hivly network

Free sister tools on our other sites.

Color Palette GeneratorShuffle palettes with the spacebar, lock favourites, copy hex codes.Length ConverterMetres, feet, miles, inches, km and more, instantly.Word CounterCount words, characters, sentences and reading time live.