DKIM checker: check your record

Look up your domain’s DKIM key using its selector. Inspect the TXT record, CNAME aliases and public key format.

In an email’s DKIM-Signature header, use d= for the domain and s= for the selector. Do not paste the entire header.

Public records queried through Cloudflare.

Where to find the selector

Open the original source of an email sent by your platform. In DKIM-Signature, s= gives the selector and d= gives the signing domain. A provider can use several selectors; there is no universal selector.

How the lookup works

We query TXT at selector._domainkey.domain, following up to eight CNAME steps. We inspect tags, RSA or Ed25519 key type, format, revocation and RSA length. No records are changed.

s=selector1; d=example.com
selector1._domainkey.example.com

What the result means

A readable key does not prove your emails are signed correctly. For an actual delivery, check Authentication-Results in the received message for dkim=pass. Sender alignment is handled by DMARC. If nothing is found, check the selector before changing DNS.

Frequently asked questions

Is DKIM the same as DMARC?

No. DKIM signs messages. DMARC checks SPF or DKIM alignment with the visible sender domain and publishes a policy.

Do I need to paste my private key?

No. Only the domain and selector are needed. The lookup reads the public key in DNS.

When will a DNS change appear?

It depends on the TTL and resolver caches. After editing DNS, wait for the previous TTL to expire and check again.

Technical documentation