DKIM Checker
Validate DKIM public key records. Check key type, key size and revocation status for any domain and selector.
Frequently Asked Questions
What is DKIM and how does it work?
DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. The sending mail server signs each email with a private key, and the recipient verifies the signature using a public key published in a DNS TXT record at the selector._domainkey.domain format. A valid DKIM signature proves the email was not modified in transit and originates from an authorised sender.
What is a DKIM selector?
A DKIM selector is a label that identifies which public key should be used to verify a message. It appears in the email header as s=selector and in DNS as selector._domainkey.yourdomain.com. Organisations use multiple selectors to rotate keys, assign different selectors to different sending services (e.g. google, mailchimp, sendgrid), or maintain separate keys for different purposes.
Why does my DKIM check fail?
Common causes of DKIM failure include: the DNS record not yet propagated after publishing; a mismatch between the selector in the email header and the DNS record; the public key in DNS being different from the private key used to sign; the DKIM signature body hash not matching (email content was modified in transit); or the record being published at the wrong DNS hostname. Check that your selector._domainkey.domain TXT record is publicly resolvable.
Do I need DKIM if I already have SPF?
Yes — SPF and DKIM serve complementary roles. SPF validates the sending IP address but breaks when email is forwarded. DKIM validates the message content and survives forwarding because the signature travels with the message. DMARC requires at least one of SPF or DKIM to pass and align with the From domain. For maximum deliverability and full DMARC enforcement, implement both SPF and DKIM.