DKIM Record Lookup

DKIM Record Lookup fetches the TXT record at selector._domainkey.<domain> to show a domain's DKIM public key and settings. DKIM cryptographically signs outgoing mail so receivers can verify it wasn't forged — together with SPF and DMARC it drives deliverability and trust.

DKIM records exist per selector. The selector varies by provider (e.g. Google Workspace uses google) and can be found in the s= value of the DKIM-Signature header of a received email.

If you don't know the selector

DKIM can't be found by domain alone — you need the selector. Check the s= value in the DKIM-Signature header of an email you received. Common values: google, default, selector1/selector2 (Microsoft), k1 (Mailchimp). To analyze a whole received header at once, use Email Header Analyzer.

Key size

We estimate the RSA key size from the public key (p). 1024-bit is weak; use 2048-bit or larger. An empty p= means the key has been revoked.

Reading DKIM record tags

A DKIM TXT value is a list of tag=value pairs separated by ;. Most people only look at p=, but the other tags can change how a receiver treats the signature.

Selectors by provider

Worked example

Entering selector google and domain example.com queries the TXT record at google._domainkey.example.com. If the result is v=DKIM1; k=rsa; p=MIIBIjANBg…AQAB, then v=DKIM1 marks it a valid DKIM record, k=rsa is an RSA key, and a p= Base64 string of roughly 392 characters indicates a 2048-bit key. If you see t=y the record is still in testing mode — receivers ignore signature failures, so remove this flag once you've finished validating to make DKIM actually count.

Common pitfall

• Doubling up _domainkey — this tool takes the selector and domain separately and builds selector._domainkey.<domain> for you. Pasting the full google._domainkey into the selector field queries the wrong name.
• Thinking a Microsoft 365 record is "empty" — selector1/2 are usually CNAMEs pointing at onmicrosoft.com, not raw TXT. A short value with no visible key is normal; you must follow the CNAME to reach the real key.
• Leaving 1024-bit keys in place — keys generated years ago are often 1024-bit. Add a fresh 2048-bit selector via key rotation, then revoke the old one (empty its p=).