What is a DKIM record?

A DKIM record is a DNS TXT record holding the public key that verifies your outgoing mail’s DKIM signature, proving the message was not altered in transit. It lives at selector._domainkey.yourdomain.

Why does the lookup need a selector?

Each signing key has a selector (e.g. “google” or “s1”) that tells receivers which _domainkey record to fetch. Enter your selector above to look up the matching public key.

Where do I find my DKIM selector?

It is in the s= field of the DKIM-Signature header of a message you sent, or in your mail provider’s DNS setup instructions. Common selectors are “google”, “default”, “s1” and “k1”.

What key length should DKIM use?

Use at least a 2048-bit RSA key; 1024-bit is weak and being phased out. Some providers also offer Ed25519 keys.

Why is my DKIM failing?

Usual causes: the published key does not match the signing key, the TXT record was split or truncated in DNS, the message was modified in transit, or the wrong selector was queried.

DKIM Record Look Up

Related tools

Domain name

What do you want to look up?

DKIM selector

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

DKIM signs outgoing mail with a private key; receivers fetch the public key from selector._domainkey.yourdomain.com to verify the message was authorized and unmodified. Each provider uses its own selector name.

How to read your result

A healthy record contains p= followed by a long base64 key. An empty p= means the key was revoked. Not finding a record often just means you queried the wrong selector — check your provider's documentation for the exact selector name.

Common problems and how to fix them

DKIM record missing for the selector the provider signs with

How it shows up: Receivers show dkim=fail or dkim=none; DMARC reports list failing sources that are actually your own provider.

How to fix it: Copy the exact record (selector and value) from your email provider's admin console into DNS. For Microsoft 365 and some others, you must also click "enable DKIM" in the console after publishing the CNAMEs.

Record truncated or reformatted by the DNS provider

How it shows up: DKIM verification fails even though the record "exists"; the key in DNS differs subtly from the one issued.

How to fix it: Re-paste the value; for keys over 255 characters ensure the provider splits them into multiple quoted strings correctly. Verify with a look up and compare the full p= value character-for-character.

Key never rotated

How it shows up: The same DKIM key has signed mail for years; a compromise of that key would let attackers sign as you indefinitely.

How to fix it: Rotate keys periodically (providers with paired selectors like selector1/selector2 automate this). Publish the new key, switch signing, then revoke the old one with an empty p= after a transition period.

Frequently asked questions

What is a DKIM record?: A DKIM record is a DNS TXT record holding the public key that verifies your outgoing mail’s DKIM signature, proving the message was not altered in transit. It lives at selector._domainkey.yourdomain.
Why does the lookup need a selector?: Each signing key has a selector (e.g. “google” or “s1”) that tells receivers which _domainkey record to fetch. Enter your selector above to look up the matching public key.
Where do I find my DKIM selector?: It is in the s= field of the DKIM-Signature header of a message you sent, or in your mail provider’s DNS setup instructions. Common selectors are “google”, “default”, “s1” and “k1”.
What key length should DKIM use?: Use at least a 2048-bit RSA key; 1024-bit is weak and being phased out. Some providers also offer Ed25519 keys.
Why is my DKIM failing?: Usual causes: the published key does not match the signing key, the TXT record was split or truncated in DNS, the message was modified in transit, or the wrong selector was queried.