How to Check DKIM for the Domains Behind an Email List

To check DKIM for the domains behind an email list, look up DKIM keys at common selector names in DNS for the domain after the @ in each address. The bulk email domain DKIM checker does this for every address in a pasted list or CSV and gives each one a row.

The check reads the domain, not the mailbox.

Why check this on an email list

A domain with a DKIM key is set up to sign mail, which shows someone configured email for it. The check is most useful for sorting a list of company domains by how they send, not for deciding whether an address works. A list of thousands of addresses has far fewer unique domains, so one set of DNS queries per domain is cheap.

The by-hand way

1. Take the domain after the @, for example acme.example from sam@acme.example.
2. Query the TXT record at selector._domainkey.acme.example, for example dig TXT selector1._domainkey.acme.example.
3. Try each common selector, such as google, selector1, selector2 and default.
4. Read the key's type and length, and repeat for every unique domain.

For the longer background, see DKIM for every sending service.

Step 1: paste the addresses

Paste addresses one per line, or upload a CSV. Only the unique domains are sent, never the mailbox names.

Step 2: run the check

Press Check DKIM. DNS queries are made for 22 common selector names plus one wildcard probe on each domain, from our server. Nothing is sent to the domains, and no mail is sent.

Step 3: read the result

Result	What it means
Key found	A key is published at a common selector
Weak key / Testing / Revoked / Broken	A key was found with the problem named
CNAME to nothing	A selector points by CNAME at a name with no key
No key at common selectors	None of the 22 names published a key; a private selector is not found

The CSV carries the selectors that had keys, the key lengths and how many selectors were tried beside each email. No address is dropped from the list handed on to the mailbox check.

What this check cannot do

• It checks the domain, not the mailbox.
• Only 22 common selector names and one wildcard probe are tried; a private selector is not found.
• A key found says the domain signs mail, not that its mail passes DKIM.
• Up to 100 unique domains a run without an account, 500 signed in.

To check a selector you name, use the bulk DKIM checker on the domains.

Next: the rest of the list

For the addresses that remain, use the verify page: the first 100 checks are free with a Google sign-in, no card.

Try it now

Paste your list into the bulk email domain DKIM checker at simpleverifier.com.