DKIM Record Checker & Validator

Run a check right after adding or changing the DNS record for a mail provider. Google Workspace usually uses the google selector, Microsoft 365 uses selector1 and selector2, Amazon SES issues three random CNAME selectors, Mailchimp uses k1 (and k2/k3), and SendGrid commonly uses s1 and s2.

Check DKIM when messages land in spam or DMARC reports show dkim=fail. A missing or malformed record is one of the most common root causes.

Verify both selectors during key rotation: providers publish a new key on a second selector before retiring the old one, and both must resolve while old signatures are still in transit.

If no record is found, confirm the exact selector spelling and that the TXT (or CNAME) record lives at selector._domainkey.yourdomain.com — a very common mistake is publishing it at the apex or doubling the domain in the host field.

If the record is found but invalid, look at the parsed tags: a missing v=DKIM1, a truncated p= value (DNS providers often split long keys into multiple quoted strings) or stray whitespace will break verification.

An empty p= tag means the key was deliberately revoked. A t=y flag means the domain is still in testing mode — receivers verify the signature but do not enforce it, so remove the flag once the rollout is confirmed.

DKIM lets a sending server sign each message with a private key; receivers fetch the matching public key from DNS using the selector named in the DKIM-Signature header (the s= tag). Selectors allow one domain to publish many keys at once.

Key length matters: 1024-bit RSA keys are still accepted but considered weak, and most providers now issue 2048-bit keys. Some DNS panels need the longer Base64 string split into two quoted chunks.

Rotate keys by publishing a new key under a new selector, switching signing to it, and only then removing or revoking the old record. Checking each selector individually confirms every step of the rotation.

You can query the record with dig TXT selector._domainkey.example.com, but you still have to parse the tags and decode the key length yourself. The validator does that automatically and explains each finding.

Reading Authentication-Results headers on a received message shows whether one specific message passed. The validator answers the earlier question: is the published record itself present and valid?

Full deliverability suites test seed inboxes and reputation. This tool covers the DNS foundation that everything else depends on — fast, free and scriptable via the API.