DKIM Record Checker
Look up a DKIM record by selector and check the key, syntax and common publication errors.
Last reviewed by the Radiatus Cloud team
DKIM Record Checker
Check if a domain has a valid DKIM record for a specific selector.
Need this handled by experts?
Radiatus runs VAPT, managed SOC & security engineering for regulated teams.
DKIM lives at a selector, not the domain root
The record sits at selector._domainkey.yourdomain.com, so you cannot check it without knowing the selector. Providers publish their own — google, s1, k1, default are common. Reading a selector from the DKIM-Signature header of a message you actually sent is the reliable way to find it.
What the signature proves
The sending server signs selected headers and the body with a private key; receivers fetch the public key from DNS and verify. A valid signature proves the message was authorised by the domain and that the signed parts were not altered in transit. Unlike SPF it survives forwarding, because it travels with the message rather than depending on the connecting IP.
Key length and rotation
1024-bit keys are still widely deployed and considered weak; 2048 is the current expectation. Anything longer often exceeds the 255-character limit of a single TXT string and must be split into multiple quoted strings within one record — a split that some DNS interfaces handle silently and others break.
Body modification breaks it
Mailing lists that append footers, and gateways that rewrite content, invalidate the body hash and cause DKIM to fail even though nothing malicious happened. The l= tag limiting the signed body length exists to tolerate this and weakens the guarantee, which is why it is generally discouraged.
Related tools
- Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
- Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
- Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
- Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.
Frequently Asked Questions
Where is a DKIM record published?
At selector._domainkey.yourdomain.com, so you need the selector to look it up. Read it from the DKIM-Signature header of a message you sent.
How is DKIM different from SPF?
DKIM signs the message cryptographically so it survives forwarding, while SPF authorises the connecting IP and breaks when mail is forwarded.
What key length should I use?
2048-bit. 1024 is weak, and longer keys exceed the 255-character TXT string limit so must be split into multiple quoted strings within one record.
Why does DKIM fail on mailing lists?
Because appended footers change the body and invalidate the hash. The l= tag tolerates this by limiting signed body length, but it weakens the guarantee.
Privacy & Security
DNS lookup.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Password Strength Checker
SecurityMeasure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
Password Generator
SecurityGenerate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
Hash Generator
SecurityGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.