DKIM record checker
Look up a DKIM selector and check the published key.
What a DKIM record does
DKIM signs outgoing messages with a private key held by your mail provider and publishes
the matching public key in DNS at
selector._domainkey.yourdomain.com. A receiver reads the
DKIM-Signature: header, fetches that key and verifies the signature, which
proves the message really came from you and was not altered in transit. Because DKIM
survives forwarding and mailing lists where SPF does not, it is the sturdier of the two
ways to make DMARC pass.
The selector is chosen by whoever sends your mail. Google Workspace uses
google, Microsoft 365 uses selector1 and
selector2, and each ESP has its own. You need one lookup per selector, so
check every sender you use. Two things go wrong most often: the key is published but the
provider was never switched on to sign with it, and the key is a legacy 1024-bit one that
large receivers are phasing out. Rotate to 2048-bit and keep the old selector live until
in-flight mail has cleared.
On a paid plan, the signing keys check gives each selector a keep, review or remove verdict from 90 days of the domain's own report history.
The senders your DNS cannot name
A DNS lookup shows the record receivers read on the next message. The reports receivers send go further: they name each host that sent under your domain and whether its mail passed. Paid plans email you the day a report first names a new sender failing. One Monday email covers 5 domains on Pro, $19 a month.
Start watching your sendersNo card · 12+ months of history · The free plan does not expire