DKIM Validator
Detect DKIM signing keys across 50+ common selectors, or enter your own selector for an exact check.
What is DKIM?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing emails, allowing receiving servers to verify the message was sent by an authorised server and was not altered in transit. Without DKIM, emails are more likely to be flagged as spam.
How This Checker Works
We probe 40+ common DKIM selectors (google, selector1, selector2, k1, sendgrid, etc.) and automatically detect your mail provider from MX records to prioritise the right selectors. If your domain uses a custom selector, you can enter it directly for an exact verification.
How the DKIM check works and why it needs a selector
A DKIM public key is published at selector._domainkey.yourdomain.com, and the selector is a name chosen by whoever configured signing. There is no DNS query that lists all selectors for a domain, so a checker can only test names it knows or guesses. This tool does both.
In automatic mode it probes a built-in list of 43 common selectors in parallel: selector1 and selector2 (Microsoft 365), google and 20161025 (Google Workspace), amazonses, s1, s2, sendgrid, em, k1, k2, mailchimp, mandrill, mx, pic, mailgun, pm, postmark, scph0224, scph0316, sparkpost, hs1, hs2, zoho, protonmail, mimecast, and generic names such as default, mail, email, smtp, dkim, dkim1, dkim2, key1, key2, sig1, sig2, mta, out, m1, m2, e1 and fe. It also reads your MX records to detect the mail provider (Google, Microsoft, Mimecast, Proofpoint, SendGrid, Mailgun, Amazon SES, Zoho or Proton) and adds that provider's known selectors to the list. If you type a selector yourself, only that one is queried.
A selector counts as found when its TXT answer contains v=DKIM1 or a k= tag. DNS aliases (CNAMEs) are followed by the resolver, so providers that publish your key through a CNAME, such as Microsoft 365, are read correctly.
How to read each result field
| Field | What it means |
|---|---|
| Status: PASS | Two or more valid selectors were found. Valid means the record has a non-empty p= value and is not in test mode. |
| Status: WARN | Exactly one valid selector, or nothing found. Nothing found is WARN rather than FAIL because the tool cannot tell a missing setup from a selector it did not guess. |
| Status: FAIL | Selectors exist but none is usable: every one is revoked or in test mode. |
| Selectors Found | How many selectors answered, out of how many were probed. |
| Mail Provider | The provider inferred from your MX records, used to prioritise selectors. It is a hint, not a guarantee of who actually signs your mail. |
| Revoked | The record exists but p= is empty. The key was deliberately withdrawn, and mail signed with it fails verification. |
| Test Mode | The record has t=y, which tells verifiers you are testing. Some receivers ignore failures for such domains, which defeats the purpose. |
| Key type / Hash | The k= value (rsa if absent, which is the default) and the h= tag if the record restricts hash algorithms. |
Common DKIM problems: cause and fix
| What you see | Likely cause | Fix |
|---|---|---|
| No selectors found, but you know DKIM is on | Your platform uses a custom or random selector the list does not include. Amazon SES, for example, publishes three CNAMEs with random token names. | Find the s= tag in the DKIM-Signature header of a real message and enter it in the custom selector box. |
| No selectors found, and you never set DKIM up | Signing was never enabled, or the DNS records were never added. | Generate the key in your mail platform, publish it, then enable signing. |
| Revoked | p= is empty, often left over from an old rotated key or a disabled service. | Delete the record if the selector is unused. If the selector is still active, publish a fresh key. |
| Test Mode | t=y was included while setting up and never removed. | Remove t=y from the TXT value and re-check. |
| Only one selector, WARN | A single key is configured. Nothing is wrong today, but there is no overlap for rotation. | Not urgent. Plan a second selector for rotation, and note that some providers such as Microsoft 365 publish two by design. |
| Found here, but mail still shows dkim=fail | The key in DNS does not match the one the platform signs with, the record was truncated or has stray spaces, or the message was altered after signing. | Compare p= with the key in your platform. See the guide to DKIM signature failures. |
How to find your selector
- Send a message from the domain to a mailbox you control, such as a Gmail address.
- Open the original message source (in Gmail: the three-dot menu, then Show original).
- Find the line beginning DKIM-Signature. Read the d= value (the signing domain) and the s= value (the selector).
- Paste the s= value into the custom selector field here. The checker queries s._domainkey.d, so make sure you are checking the same domain as d=.
Example DKIM-Signature header
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google; t=1759650000; bh=...; h=from:to:subject:date; b=...
If d= is a different domain (for example your email platform's domain), the message is signed on the platform's behalf and not aligned with your From domain. That passes DKIM but will not satisfy DMARC alignment.
Best practices
- Use 2048-bit RSA keys. 1024-bit keys are still the minimum in RFC 8301 but are weak by current standards, and some providers default to them if you do not choose.
- Rotate keys on a schedule, publishing the new selector before switching signing over and retiring the old record afterwards.
- Enable DKIM for every service that sends as your domain, not only your mailbox provider. DMARC passes when either SPF or DKIM passes and aligns, so independent DKIM keeps mail passing when SPF breaks, for example on forwarding.
- Remove t=y once you are live, and delete revoked or unused selectors.
- Re-check after DNS changes. Propagation can take from minutes to hours depending on the TTL.
Limitations of this checker
- It cannot discover unknown selectors. A domain that signs correctly with an unlisted selector shows as not found until you supply the selector.
- It reads DNS only. It does not confirm that your mail platform is actually signing messages, and it does not verify a real signature.
- It reports key type and hash tags, but it does not measure key length or validate that the p= value is a well-formed public key.
- MX-based provider detection fails when mail is routed through a gateway or filtering service in front of your mailbox provider.
- Subdomains are checked only if you enter them. Selectors published under a subdomain are not found by checking the parent domain.
Related tools and guides
DKIM Record Generator
Format a public key into the exact DNS TXT record for your selector.
DKIM signature failed
Why verification fails even when the record exists, and how to fix it.
How to read email headers
Find the selector and authentication results in a real message.
SPF, DKIM and DMARC explained
How the three protocols work together.
Frequently Asked Questions
What is DKIM and do I need it?
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic digital signature to outgoing emails. The signature is verified by receiving servers against a public key published in your domain's DNS. Without DKIM, your emails cannot achieve full DMARC alignment, and they are more likely to be flagged as spam. Both SPF and DKIM are required for DMARC to work reliably.
What DKIM selectors does this checker test?
This tool probes 40+ common DKIM selectors including default selectors for Google Workspace (google), Microsoft 365 (selector1, selector2), Mailchimp, Sendgrid, HubSpot, Zoho, and many other popular email providers. It automatically detects your likely mail provider based on your MX records and tests the most relevant selectors first.
What does a revoked DKIM key mean?
A DKIM record with an empty p= value (p=) means the key has been intentionally revoked. Revoked keys were deliberately retired — usually after a security incident or a platform migration. If your active signing key is showing as revoked, DKIM signatures will fail verification at receiving servers, breaking DMARC alignment and potentially causing deliverability failures.
How do I set up DKIM for Google Workspace or Microsoft 365?
For Google Workspace: go to Admin Console → Apps → Google Workspace → Gmail → Authenticate email → Generate DKIM key, then add the provided TXT record to your domain's DNS. For Microsoft 365: go to the Defender portal → Email & collaboration → Policies & rules → Threat policies → DKIM, enable signing for your domain and add the two CNAME records shown. This checker will confirm the key is live once DNS propagates (allow up to 48 hours).
Why does my DKIM checker show no record found?
No DKIM record found typically means one of three things: DKIM signing has not been enabled in your email platform yet; the signing key was configured under a non-standard selector not included in this tool's list; or the DNS record was recently added and has not finished propagating (allow 24–48 hours). Try the full Email Security Score check, which tests DKIM as part of a combined audit and includes additional selector probing.