How do I check if DKIM is set up on a domain?

Test the common selectors. Paste the domain into the tool above and it queries the selectors used by Google, Microsoft, SendGrid, Zoho and other major providers. If one responds, DKIM is published. If none do, the domain may still use a custom selector, so treat that as inconclusive.

What is a DKIM selector?

A selector is the label that identifies which DKIM key to use, and it forms part of the DNS hostname where the public key lives: selector._domainkey.yourdomain.com. It lets a domain publish several keys at once, which is what makes key rotation possible without downtime.

Why can't a DKIM checker find my record?

Almost always because your provider uses a selector the tool did not test. Selectors cannot be enumerated from DNS, so every DKIM checker guesses from a list of common ones. Find the selector in your email provider's DNS instructions, or in the DKIM-Signature header of a message you have sent, where it appears as s=.

Do I need both SPF and DKIM?

Yes, and DMARC as well. SPF validates the sending server but breaks on forwarding and only checks the envelope sender. DKIM validates the message itself and survives forwarding. DMARC ties either result to the From address a recipient sees, which is the part that actually stops spoofing.

DKIM record checker

A DKIM check looks for the public keys a domain publishes in DNS. Because each key sits at a selector-specific hostname rather than a fixed one, the tool tests the selectors the major providers use — `google`, `selector1`, `selector2`, `k1`, `s1` and others — and reports which respond.

Domain

Free, no account. Ten lookups a minute per IP.

Why DKIM needs a selector

SPF and DMARC live at predictable names, so checking them is straightforward. DKIM does not: the public key is published at selector._domainkey.yourdomain.com, and the selector is chosen by whoever set it up. There is no way to enumerate them from DNS, so any checker has to guess.

The guessing works reasonably well because providers are consistent. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, SendGrid uses s1 and s2, Zoho uses zoho, Mailchimp uses k1. A domain using a custom selector will show as not found here even though DKIM is configured correctly — so read a negative result as inconclusive rather than as failure.

What DKIM actually proves

The sending server signs parts of the message — headers and body — with a private key, and publishes the matching public key in DNS. A receiver verifies the signature and learns two things: the message really came from that domain, and it was not modified in transit.

The second half is what makes DKIM more durable than SPF. Forwarding changes the sending IP, which breaks SPF, but the signature still validates. That is why DKIM is the authentication mechanism that survives mailing lists and forwarders, and why DMARC alignment on DKIM is generally more reliable than on SPF.

Common failure modes

A failing signature is worse than no signature, because it looks like tampering rather than absence. The usual cause is a key rotated at the sending end without the DNS record being updated, which produces a window where every message is signed with a key nobody can find.

Key length matters too. 1024-bit keys are still widely deployed and still accepted, but 2048-bit is the current recommendation. Some DNS providers make publishing a 2048-bit key awkward because of TXT record length limits, which is why short keys persist.

Common questions

How do I check if DKIM is set up on a domain?: Test the common selectors. Paste the domain into the tool above and it queries the selectors used by Google, Microsoft, SendGrid, Zoho and other major providers. If one responds, DKIM is published. If none do, the domain may still use a custom selector, so treat that as inconclusive.
What is a DKIM selector?: A selector is the label that identifies which DKIM key to use, and it forms part of the DNS hostname where the public key lives: selector._domainkey.yourdomain.com. It lets a domain publish several keys at once, which is what makes key rotation possible without downtime.
Why can't a DKIM checker find my record?: Almost always because your provider uses a selector the tool did not test. Selectors cannot be enumerated from DNS, so every DKIM checker guesses from a list of common ones. Find the selector in your email provider's DNS instructions, or in the DKIM-Signature header of a message you have sent, where it appears as s=.
Do I need both SPF and DKIM?: Yes, and DMARC as well. SPF validates the sending server but breaks on forwarding and only checks the envelope sender. DKIM validates the message itself and survives forwarding. DMARC ties either result to the From address a recipient sees, which is the part that actually stops spoofing.

Check everything at once

This page covers one record. The full deliverability audit runs MX, SPF, DKIM, DMARC and blocklists together and scores the domain — or read the glossary entry for the concept behind this check.

You audited one domain. Cold outreach means thousands.

This tool checks a domain you type in. It will not tell you which addresses at that domain are real.

Bulk mailbox verification with real SMTP checks
The email finder — name plus company to a verified address
Website enrichment for emails, owner names and socials

Get started — $29.99/mo See the published limits first

One plan, cancel anytime, no contract. The free tools stay free and unmetered either way — they are not a trial.