DKIM record checker
Look up a DKIM selector and check the published key.
A DKIM record publishes your public key in DNS so receiving mail servers can verify cryptographic signatures on your outbound email. Because DKIM signatures stay intact across email forwarding and mailing lists where SPF breaks, DKIM is the sturdier foundation for your DMARC policy. You can test your overall policy with our DMARC checker.
Questions
How does DKIM authenticate your email?
Your email provider signs outgoing messages using a private key and places the signature in
the DKIM-Signature: header. The receiver fetches your matching public key from
DNS at selector._domainkey.yourdomain.com and verifies the signature. This
confirms the message came from you and was not altered in transit.
What is a DKIM selector and where do you find it?
The sender assigns the selector name. Google Workspace uses google, Microsoft
365 uses selector1 and selector2, and email service providers use
their own. Because each sending service requires its own selector, run our
DKIM checker for each vendor you use.
What are the most common DKIM configuration mistakes?
Two issues happen most often. First, an admin publishes the DNS key but never turns on signing inside the provider's console. Second, the domain uses an older 1024-bit key that large receivers now phase out. Upgrade to 2048-bit keys, and keep old selectors live until in-flight mail clears.
How do you know which DKIM selectors still sign live mail?
On a paid plan, our signing keys check evaluates each selector against 90 days of your domain's DMARC report history. We show you exactly which keys sign active mail and mark each selector keep, review, or remove so you can clean up stale DNS records safely.
Stop reading raw DMARC XML reports by hand
Mailbox providers generate XML files containing IP addresses, volumes, and authentication pass rates for your domain. DomainCanary digests that data into one concise weekly summary, highlighting what changed and what needs attention. Your first domain is free, with per-source totals kept for the life of the account.
Monitor your domain freeFree for your first domain · No card · Per-source totals kept for life