DKIM checker
Look up a DKIM key for a domain and selector, and see whether a public key is actually published.
DKIM keys are published per selector — check the raw headers of a real email from this domain (the DKIM-Signature header's s= tag) if you don't already know it.
Enter a domain and selector
The public key, if one is published under that selector, appears here.
DKIM adds a cryptographic signature to outgoing email, allowing a receiving server to verify that the message was not altered in transit and genuinely originated from a server authorized by the sending domain. The public key required to verify that signature is published as a DNS TXT record at <selector>._domainkey.<domain>. The selector is chosen by whoever configured mail sending and cannot be inferred from the domain alone.
Identifying the correct selector typically requires examining the DKIM-Signature header of an actual email from that domain; the s= tag in that header specifies the selector to check. A record with an empty p= tag indicates a deliberately revoked or rotated key, not a missing one — providers do this routinely when cycling keys.
DKIM alone does not specify what a receiving server should do with mail that fails verification. That determination is made by DMARC, which uses DKIM's pass/fail result as one of its inputs.