Free DKIM Checker

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outbound email. The sending server signs the message with a private key, and the receiving server looks up the corresponding public key in DNS to verify the signature. If the signature is valid, the receiver knows the message was not tampered with in transit and that it genuinely came from the claimed domain.

A DKIM DNS record is a TXT record published at selector._domainkey.yourdomain.com, where "selector" is a label chosen by your email provider (e.g. google for Google Workspace, selector1 for Microsoft 365).

Why DKIM Matters

• Prevents tampering: DKIM proves that the email body and key headers have not been modified after the sender signed them.
• Supports DMARC alignment: DMARC can use DKIM alignment (the d= domain in the signature matching the From header) to authenticate messages, even when SPF fails due to forwarding.
• Improves deliverability: Major receivers (Google, Microsoft, Yahoo) use DKIM as a positive signal when deciding whether to deliver, spam, or reject a message.
• Not covered by the Security Grade: DNS gives no way to list a domain's selectors, so the Security Grade Checker leaves DKIM out rather than mark a domain down for a key it could not find. Check it here instead.

Common DKIM Selectors by Provider

Every check tries google, selector1, selector2, s1, s2, k1 and protonmail, plus other common selectors. When you are signed in, it also tries mandrill, protonmail2, protonmail3 and a longer list for other platforms. It also reads the domain's MX and SPF records and tries the selectors of the providers they name, so a Proton Mail domain is checked at all three of its selectors whether or not you are signed in. Amazon SES creates selectors for each domain, so enter yours in the custom selectors field. Add any other selector your provider gave you there too, up to 10.

What This Tool Checks

• Selector scanning: Probes common DKIM selectors used by major email providers
• Public key presence: Whether a valid DKIM TXT or CNAME record exists for each selector
• Published record: The full key record for each selector that has one
• SPF and DMARC context: Whether the domain also has SPF and DMARC configured

How to set up DKIM for your email provider

Each provider below creates the DKIM key pair for you. It keeps the private key to sign your mail, and you publish the public key, or a pointer to it, at a selector under _domainkey in your DNS. The pattern is the same for each of them: turn DKIM on in the provider's admin console, publish the record it gives you exactly as shown, then let the provider check it and start signing.

You need an administrator account at the provider and access to your domain's DNS, which is usually managed at your registrar (such as Cloudflare, GoDaddy or Namecheap) or your hosting provider. Some providers give you a TXT record that holds the public key itself. Others give you CNAME records that point at a key they host, so they can change the key without you editing DNS.

Host:  google._domainkey.example.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Host:  abcdef1234._domainkey.example.com
Type:  CNAME
Value: abcdef1234.dkim.amazonses.com

How to check DKIM is working

Run the checker at the top of this page once the record is published. It shows the record at each selector it finds, with the key type and size, and flags a key that is cut short, revoked or in testing mode.

Then send a message from the domain to a Gmail or Outlook mailbox, open its full headers and look for dkim=pass in the Authentication-Results header, with your own domain as the signing domain. DMARC counts a DKIM pass only when that domain aligns with the From address. Our Email Header Analyser reads the result and the alignment for you.

Common DKIM problems and fixes

• Record not found after publishing: DNS changes can take up to 48 hours to reach every resolver. Check the host name as well. Many DNS hosts add your domain to whatever you type, so google._domainkey.example.com entered in full becomes google._domainkey.example.com.example.com. On those hosts, enter google._domainkey alone.
• Selector mismatch: receivers look up the key at the selector in the s= tag of the DKIM-Signature header, so publish it under exactly the selector your provider signs with.
• Key cut short: a TXT string holds at most 255 characters, so a 2048-bit key is split into quoted strings that receivers join back together. Many DNS hosts split it for you. If the checker says the key is not a complete RSA key, paste the full value again.
• Testing mode left on: t=y tells receivers you are testing DKIM, so they treat a message whose signature fails like an unsigned one (RFC 6376). Remove it once DKIM passes.
• 1024-bit key: RFC 8301 sets 1024 bits as the minimum for RSA keys and says signers should use at least 2048. Generate a 2048-bit key in your provider's console. Where you publish the key yourself, put the new one under a new selector and remove the old record once nothing signs with it.

Keys can also change after set-up, when a provider rotates them or someone edits your DNS. On the Professional and MSP plans, and free during the 30-day trial, ShieldMarc's DKIM monitor re-checks a domain's keys daily and emails you when one is removed, revoked or weakened.

DKIM, SPF, and DMARC: The Complete Picture

DKIM is one of three email authentication protocols. SPF verifies the sending server, DKIM verifies the message integrity, and DMARC ties them together with a policy that tells receivers what to do when both fail. For full protection, you need all three.

Check all three protocols at once with our DMARC Checker, or learn how they work together in our SPF vs DKIM vs DMARC guide.