Free · no sign-up
Free DKIM record checker
Find and validate a domain’s DKIM public key. Enter the selector if you know it — or leave it empty and we try the most common ones.
What the DKIM checker validates
- a DKIM record exists at
selector._domainkey.your domain; - the record is well formed (
v=DKIM1, key typek=and public keyp=); - the public key can actually be read, and how long it is (1024 or 2048 bits);
- the key is not revoked (empty
p=) and not left in testing mode (t=y).
Common DKIM selectors
Without a selector we try the names used by popular services, such as google (Google Workspace), selector1 and selector2 (Microsoft 365), zmail (often used with Zoho), protonmail (Proton), k1 (Mailchimp) and s1/s2 (SendGrid). If yours is not found, open an email you sent, view the original message and look for s= in the DKIM-Signature header.
How to fix a failing DKIM record
- Copy the DKIM record again from your email provider. Long keys are often cut off when pasted into DNS panels — some panels need the value split into several quoted strings.
- Make sure the host name is exactly
selector._domainkey(many DNS panels add your domain automatically, so do not type it twice). - Wait for DNS to update, then check again here.
- Turn on DKIM signing in your email provider after the record is live.
When you send with InboxRoads, adding a custom sending domain generates your DKIM record (a 2048-bit key by default) and checks the DNS automatically. Read SPF, DKIM and DMARC explained for how the three records work together.
Frequently asked questions
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server looks up your public key in DNS and checks the signature, which proves the message really came from your domain and was not changed on the way.
The selector is the name of the key, chosen by your email provider — for example "google" for Google Workspace or "selector1" and "selector2" for Microsoft 365. The key is published at selector._domainkey.yourdomain.com. You can find it as "s=" in the DKIM-Signature header of an email you sent.
Use 2048 bits. 1024-bit keys are still accepted by most receivers, but 2048 bits is the current recommendation. Keys shorter than 1024 bits are rejected by major mailbox providers.
Yes. Each service that sends for you (your mailbox provider, your newsletter tool, your app) can have its own selector and key. They do not conflict.
DMARC also needs alignment: the domain in the DKIM signature (d=) must match the domain in the From address. If a service signs with its own domain, DKIM passes but does not count for DMARC — set up DKIM for your own domain in that service.
Verify your whole list, not just one address
Upload a CSV and InboxRoads checks every address, removes duplicates for free and gives you clean files to download.