This free DKIM record checker that resolves the live record at selector._domainkey, validates the public key, and flags truncation, weak key length, and testing mode. A DKIM record checker and validator in one, no signup.
A DKIM checker resolves the TXT record at selector._domainkey.yourdomain and validates the public key it finds. Unlike SPF or DMARC there is no fixed hostname, which is why the DKIM checker asks for the selector — a perfect DKIM record at the wrong selector is simply unreachable.
This free DKIM record checker parses the key rather than reporting that a string exists. Truncation is the common failure: a DKIM public key is long, and DNS panels split long TXT values in ways that produce a record which looks correct in the panel and validates as broken. Only a live DKIM record checker sees that.
It is a DKIM record checker and validator rather than a lookup: key length, key type, the v=DKIM1 tag, and the t=y testing flag are all reported. Run the DKIM checker after every publish and after any provider key rotation.
If you do not know the selector, read the s= tag in a DKIM-Signature header from a message you sent. These are the defaults the DKIM record checker sees most often.
Google Workspace signs with the google selector by default. Query it in the DKIM checker first.
Microsoft 365 uses selector1 and selector2 via CNAME. Run the DKIM checker against both.
SendGrid uses s1 and s2 through CNAME records. The DKIM checker follows the chain automatically.
Amazon SES publishes three CNAME selectors. Check each one in the DKIM checker after setup.
What it resolves
A DKIM checker resolves the TXT record at selector._domainkey and validates the public key it finds. That hostname is where most DKIM problems hide, because a perfect record at the wrong selector is unreachable and no DKIM checker can find it.
Unlike SPF or DMARC, there is no fixed hostname to query. The DKIM checker asks for the selector because a DKIM record lives at selector._domainkey.yourdomain and nowhere else.
If you do not know the selector, read the DKIM-Signature header of a message you sent. The s= tag is the selector the DKIM record checker needs.
A DKIM record can exist and still be broken: truncated by a DNS panel, missing the v=DKIM1 tag, or carrying a malformed base64 key. A free DKIM record checker parses the key rather than reporting that a string exists.
Truncation is the common one. A DKIM public key is long, and panels split long TXT values in ways that produce a record which looks right and validates as broken.
2048-bit RSA is the modern default. A DKIM record checker and validator reports what is actually published, which is how you find the 1024-bit key a provider set up years ago and nobody rotated.
Key type matters less in practice — essentially every deployment is RSA.
t=y marks a DKIM record as testing, and receivers treat signatures accordingly. Records left in testing mode after launch are a common oversight.
A DKIM checker that ignores the t tag will call a record valid while receivers discount every signature it covers.
Findings
Five findings, each with a specific fix.
Either the selector is wrong or the record was never published. Check the s= tag in a real DKIM-Signature header before assuming the record is missing.
A DKIM checker cannot guess the selector, and trying a few in the DKIM checker is faster than reading provider documentation.
The classic DNS-panel failure. A free DKIM record checker will report a malformed key where the panel shows a complete one.
Republish the record, ideally pasting it as a single unbroken value, then re-run the DKIM record checker after propagation.
Valid, and weaker than it should be. Most providers now issue 2048-bit keys and support rotation.
Rotate through your provider rather than editing by hand; the DKIM checker will confirm the new key resolves.
t=y is still set. Receivers know the signature is not to be trusted operationally.
Remove the flag and republish. This is a one-character fix that a DKIM record checker and validator finds in seconds and that can sit unnoticed for years.
DKIM passing and DKIM aligning are different things. The signing domain has to match the visible From domain for DMARC to accept it.
Read the Authentication-Results header of a real message; a DKIM record checker alone cannot see alignment.
When to run it
DKIM breaks silently, and the only symptom is mail quietly failing alignment weeks later — which is why a DKIM checker belongs in the routine rather than in the emergency.
Propagation plus panel mangling means the record you saved and the one served are not reliably identical. Run any free DKIM record checker as soon as propagation finishes.
This one habit catches the truncation failure before any mail is affected.
Providers rotate DKIM keys on their own schedule, and CNAME-based setups update automatically while TXT-based ones do not.
Re-run the DKIM checker after any provider notification about key rotation.
Aggregate reports name the failing source. Query that provider's selector with the DKIM record checker before assuming the provider is at fault.
Half the time the record is simply missing for a sender nobody remembered to configure.
Moving to p=reject with a broken DKIM record on any legitimate sender loses real mail on day one.
Check every selector first, then verify the recipient list too with Email Verifier — authentication and list hygiene fail campaigns independently.
Limits
A DKIM record checker resolves one record. Four things stay outside it.
A published record and an actually-signing provider are different states. The DKIM checker reads DNS; it cannot tell whether your ESP is applying the signature.
Send a test message and read the DKIM-Signature header to confirm signing is live.
DKIM passing and DKIM aligning with the visible From domain are separate. Only DMARC evaluation surfaces the difference.
A clean DKIM checker result on a misaligned signing domain still fails DMARC.
There is no way to enumerate selectors from DNS. The DKIM checker needs the selector, and the authoritative source is your provider or a real DKIM-Signature header.
This is a protocol property, not a tool limitation.
Sender authentication and recipient verification are unrelated. A perfect DKIM record does not mean the addresses you send to exist.
Run both before a campaign.
Reference
DKIM is defined by the IETF, and the tools beside this DKIM checker cover what a DKIM checker does not.
The IETF's RFC 6376 defines DKIM, its tags, and the selector convention this DKIM record checker validates against.
Every finding our free DKIM record checker reports maps back to a rule in that document.
If the DKIM checker finds nothing, the DKIM Record Generator builds a valid record at the correct selector hostname.
Generate there, verify with the DKIM record checker here; neither tool catches panel mangling alone.
DKIM is one third. The SPF Checker and the DMARC checker cover IP authorisation and From-domain alignment.
A clean DKIM record checker result on a domain with no DMARC policy is signed and still spoofable.
Nineteen free tools alongside the paid AI features, none of them requiring an account.
Free Tools
Free DKIM record generator: build the v=DKIM1 TXT record and the selector._domainkey hostname for any provider. A free DKIM DNS record generator, no signup.
Domain or infrastructure evidence — not mailbox proof.
Free Tools
Free SPF record checker: resolve the live SPF record for any domain, count DNS lookups, and validate the syntax. SPF record checker and validator, no signup.
Free Tools
Free DMARC record checker: resolve the live DMARC record for any domain, parse every tag, and report the effective policy. DMARC record checker and validator, no signup.
Free Tools
Free DNS record lookup for any domain: A, AAAA, MX, TXT, NS, CNAME, SOA resolved live from authoritative nameservers. DNS record lookup tool, free, no signup.
Email Tools
Free email header analyzer: paste raw headers and get SPF, DKIM, DMARC verdicts, the full delivery path, and every key header. Parse email headers online free.
Sender or message diagnostics — not address discovery.
Email Tools
Free email deliverability test: send one message and get authentication, DNS, spam-filter, blacklist, header, and content scores. A free email inbox placement test, no signup.
Yes — our free DKIM record checker with no signup and no account. Run the DKIM checker on as many domains and selectors as you need. It resolves live DNS on every request rather than serving a cached DKIM verdict.
Because a DKIM record lives at selector._domainkey.yourdomain and there is no way to enumerate selectors from DNS. A DKIM record checker and validator cannot guess it. Read the s= tag in a real DKIM-Signature header, or check your provider's documentation.
That is almost always DNS-panel truncation. A DKIM public key is long, and many panels split or clip long TXT values on save. Our free DKIM record checker reports what your nameservers actually serve, which is the only version receivers see. Republish as a single unbroken value and re-run the DKIM record checker.
The t=y tag marks the record as testing, and receivers discount signatures it covers. A DKIM record checker and validator flags it because records left in testing mode after launch are a common and long-lived oversight.
It is valid and weaker than it should be. Most providers now issue 2048-bit keys. Rotate through your provider rather than editing the record by hand, then confirm with the DKIM checker that the new key resolves cleanly.
DKIM passing and DKIM aligning are different things: the signing domain has to match the visible From domain. A clean DKIM record checker result on a misaligned signing domain still fails DMARC. Read the Authentication-Results header of a real message to see which one broke.
This free DKIM record checker, no signup. Resolve the live record at your selector, validate the key, and catch truncation before receivers do.
Free DKIM record checker · DKIM checker, live DNS · DKIM record checker and validator · DKIM checker, no account
