Overview
Introduction
DKIM lets a receiving mail server cryptographically verify that a message wasn't altered in transit and genuinely came from a domain that authorized it, but the DNS record backing it is easy to publish wrong.
This tool looks up a domain's DKIM record for a given selector and breaks its tags apart individually, so a typo or missing public key is obvious at a glance instead of buried in one long string.
What Is DKIM Record Checker?
A DKIM DNS record lookup and parser that queries <selector>._domainkey.<domain> and decodes its version, key type, public key, and flag tags.
It's part of this site's DNS & Domain Tools collection; the DNS lookup is a real, live query to a public resolver.
How DKIM Record Checker Works
The selector and domain are combined into the standard DKIM query name and looked up as a TXT record via DNS-over-HTTPS.
The record's semicolon-separated tags (v=, k=, p=, and so on) are split apart and shown individually, with the public key truncated for readability since it's often hundreds of characters long.
When To Use DKIM Record Checker
Use it right after configuring DKIM with an email provider, to confirm the TXT record actually published correctly before sending real mail.
It's also useful for auditing an existing setup, like checking whether an old selector's key has been revoked (an empty p= tag) after a key rotation.
Often used alongside SPF Record Checker, DMARC Record Checker and MTA-STS Checker.
Features
Advantages
- Breaks the record into individual tags instead of leaving you to parse one long semicolon-delimited string by eye.
- Flags a revoked (empty public key) record explicitly, which is easy to miss in the raw text.
Limitations
- Requires knowing the correct selector in advance; there's no way to discover it purely from DNS.
- Only checks the DNS-published key, not whether real outgoing mail is actually being signed with it.
Examples
Best Practices & Notes
Best Practices
- Verify the record immediately after configuring DKIM with a provider, since a copy-paste error in the selector or record is a common cause of mail landing in spam.
- Keep old selectors' records in place (even if empty) rather than deleting them entirely, so any mail still in transit with the old signature fails cleanly instead of hitting an NXDOMAIN.
Developer Notes
Tag parsing splits on ';' and the first '=' in each segment, since public key values (the p= tag) are base64 and can themselves contain '=' padding characters that a naive split("=") on every occurrence would corrupt.
DKIM Record Checker Use Cases
- Verifying a DKIM TXT record was published correctly right after configuring it with an email provider
- Auditing whether an old selector has been properly revoked after rotating DKIM keys
- Debugging a DKIM authentication failure by checking whether the expected record actually exists
Common Mistakes
- Guessing at the selector instead of checking the exact value the mail provider assigned, since it's arbitrary and provider-specific.
- Assuming a record that resolves means mail is being signed correctly; this tool only confirms the key is published, not that it's in active use.
Tips
- Common selectors to try if you don't know yours: default, selector1, selector2, google, and k1, though your provider's documentation is the authoritative source.