DKIM Record Checker
Look up and validate DKIM public key records. Verify your signing configuration, key strength, and setup correctness.
How DKIM Signing Actually Works
DKIM (defined in RFC 6376) is public-key cryptography applied to email. When your mail server sends a message, it computes a hash of the message body, then signs that hash together with a chosen set of headers — typically From, Subject, Date, and To — using a private key that never leaves your infrastructure. The result is attached as a DKIM-Signature header carrying the signing domain (d=), the selector (s=), the body hash (bh=), and the signature itself (b=). The receiving server fetches your public key from DNS at <selector>._domainkey.<domain> and verifies that nothing signed was altered in transit.
The selector is what makes this system scale: each sending service publishes its key under its own label, so one domain can sign through many providers at once. If you do not know which selector to check, open a message sent from your domain and view its raw headers — the s= tag in the DKIM-Signature header names it. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, Mailchimp uses k1, and SendGrid typically uses s1 and s2.
DKIM's real payoff comes through DMARC. A DMARC pass requires that either SPF or DKIM verify with a domain that aligns with the visible From header — and DKIM is the more durable half of that pair, because a valid signature survives forwarding while SPF does not. A message signed with d=yourdomain.com keeps proving its origin no matter how many hops it takes, which is why getting DKIM right is the single most important step before tightening a DMARC policy to quarantine or reject.
DKIM Concepts Worth Knowing
Frequently Asked Questions
What is a DKIM selector?
A DKIM selector is a label that allows a domain to have multiple DKIM keys. The selector is included in the DKIM-Signature header of each email. For example, selector "google" is looked up at google._domainkey.domain.com.
How do I find my DKIM selector?
Look at the headers of an email sent from your domain. Find the DKIM-Signature header — it contains s= followed by the selector. You can view email headers in Gmail (Show Original) or Outlook (Message Source).
What DKIM key size should I use?
Use a minimum of 2048-bit RSA keys. 1024-bit keys are considered weak and can be factored. For maximum security, use 2048-bit or 4096-bit keys.
Why does DKIM matter for email deliverability?
Major providers (Google, Microsoft, Yahoo) use DKIM as a key signal for inbox vs spam placement. Without DKIM, emails are more likely to be flagged, especially since Google and Yahoo's 2024 bulk sender requirements.
What happens when DKIM verification fails?
A failed DKIM signature does not automatically send mail to spam — receivers simply treat the message as unsigned and fall back to other signals like SPF and sender reputation. Under a DMARC policy, however, a DKIM failure means the message must pass SPF with an aligned domain or it will be quarantined or rejected. The most common causes of failure are messages modified in transit (mailing list footers, corporate disclaimers), signing with a selector whose DNS record was deleted, and public keys truncated when pasted into DNS.
Can I have multiple DKIM selectors at the same time?
Yes — that is exactly what selectors are for. Each sending service gets its own selector and key pair: Google Workspace signs with "google", Microsoft 365 with "selector1" and "selector2", Mailchimp with "k1", and SendGrid with "s1" or "s2". Multiple selectors also enable zero-downtime key rotation: publish the new key under a new selector, switch your mail server to sign with it, then remove the old record once mail in transit has cleared.
How often should I rotate DKIM keys?
Common practice is to rotate DKIM keys every six to twelve months, and immediately if a signing server may have been compromised. Because the private key lives on your mail infrastructure, a leaked key lets an attacker sign fraudulent mail as your domain until the DNS record is removed. Rotation is low-risk if you publish the new key under a fresh selector and leave the old record in place for a few days before deleting it.
Does DKIM encrypt my email?
No. DKIM provides authentication and integrity — proof of which domain signed the message and that the signed parts were not altered — but the message content itself is not encrypted by DKIM. Transport encryption is handled separately by TLS between mail servers, and end-to-end confidentiality requires S/MIME or PGP. Think of DKIM as a tamper-evident seal, not a sealed envelope.
Get Alerted When Your DKIM Record Breaks
CertNotify monitors your DKIM, SPF, and DMARC records around the clock and alerts you the moment a key is revoked, a selector goes missing, or your signing configuration changes.