DKIM record checker
Look up a DKIM selector and check the published key.
In a DKIM record, you publish your public key in DNS, and receiving mail servers use it to check the signatures on your outbound email. A DKIM signature still passes after forwarding, where SPF fails, so get DKIM right before you tighten your DMARC policy. You can test your overall policy with our DMARC checker.
This lookup only shows what you published in DNS. Your DMARC reports show
which of your real senders pass, and we read them to decide when each step toward
p=reject is safe.
DMARC enforcement with automatic rollback
Get your domain to p=reject without blocking your own mail
We read your DMARC reports and email you each step once they show it's safe. You approve every step. When a sender you marked as yours sends enough mail to measure and a step starts blocking it, we put the previous policy back.
p=nonereports onlyp=quarantineyou approvep=rejectyou approve
Rollback needs hosted DMARC, on the Starter plan and up. You can try it free for 30 days with no card. Rollback works in the days after each step, and it can't bring back mail a receiver already refused. How rollback works
Create your account
Continue with Googleor
Free for your first domain · No card · Per-source totals kept for life
MSPs can group domains by client.
Questions
How does DKIM authenticate your email?
Your email provider signs outgoing messages using a private key and places the signature in
the DKIM-Signature: header. The receiver fetches your matching public key from
DNS at selector._domainkey.yourdomain.com and verifies the signature. This
confirms the message came from you and was not altered in transit.
What is a DKIM selector and where do you find it?
The sender assigns the selector name. Google Workspace uses google, Microsoft
365 uses selector1 and selector2, and email service providers use
their own. Because each sending service requires its own selector, run our
DKIM checker for each vendor you use.
What are the most common DKIM configuration mistakes?
The commonest mistake is publishing the DNS key but never turning on signing in the provider's console. Another is an older 1024-bit key, which large mailbox providers are phasing out. Upgrade to 2048-bit keys, and keep old selectors live until in-flight mail clears.
How do you know which DKIM selectors still sign live mail?
On the Business plan and up, our signing keys check compares each selector with 90 days of your domain's DMARC report history. We list the keys that still sign your mail and mark each selector keep, review, or remove, so you know which old records you can delete.