DKIM Record Checker

DKIM lives at a selector, not the domain root

The record sits at selector._domainkey.yourdomain.com, so you cannot check it without knowing the selector. Providers publish their own — google, s1, k1, default are common. Reading a selector from the DKIM-Signature header of a message you actually sent is the reliable way to find it.

What the signature proves

The sending server signs selected headers and the body with a private key; receivers fetch the public key from DNS and verify. A valid signature proves the message was authorised by the domain and that the signed parts were not altered in transit. Unlike SPF it survives forwarding, because it travels with the message rather than depending on the connecting IP.

Key length and rotation

1024-bit keys are still widely deployed and considered weak; 2048 is the current expectation. Anything longer often exceeds the 255-character limit of a single TXT string and must be split into multiple quoted strings within one record — a split that some DNS interfaces handle silently and others break.

Body modification breaks it

Mailing lists that append footers, and gateways that rewrite content, invalidate the body hash and cause DKIM to fail even though nothing malicious happened. The l= tag limiting the signed body length exists to tolerate this and weakens the guarantee, which is why it is generally discouraged.