Skip to content
Kordu Tools
Network & IP Updated 08 Apr 2026

DKIM Checker

Look up and validate DKIM records for any domain — public key, key type, and selector auto-detection.

Loading rating…

How to use DKIM Checker

  1. Enter a domain

    Type the domain you want to check — for example, gmail.com or yourdomain.com.

  2. Choose lookup mode

    Select 'Manual selector' if you know the DKIM selector (e.g., google, default, k1). Select 'Auto-detect' to scan 20+ common selectors automatically.

  3. Run the check

    Click the button or press Enter. The tool queries the DNS TXT record at selector._domainkey.domain via Cloudflare DNS-over-HTTPS.

  4. Review results

    See the public key, key type, hash algorithms, flags, and any warnings about the DKIM configuration.

DKIM Checker FAQ

What is DKIM?
DKIM (DomainKeys Identified Mail) is an email authentication method that lets a domain digitally sign outgoing messages. The receiving server checks the signature against the public key published in DNS to verify the email is legitimate and unmodified.

What is a DKIM selector?
A DKIM selector is a label that identifies which DKIM key to use for verification. A domain can have multiple selectors (e.g., 'google' for Google Workspace, 'selector1' for Microsoft 365). The full DNS lookup name is selector._domainkey.domain.

How does auto-detect mode work?
Auto-detect queries 20+ commonly used DKIM selectors (google, default, selector1, selector2, k1, dkim, mail, protonmail, zoho, etc.) in parallel. Any selector that returns a valid DKIM TXT record with a public key is reported.

What does an empty public key mean?
An empty public key (p=) means the DKIM key has been revoked. The domain owner has deliberately disabled that selector. Emails signed with this selector will fail DKIM verification.

What key types does DKIM support?
DKIM supports RSA (the default and most common) and Ed25519 keys. RSA keys are typically 1024 or 2048 bits. Ed25519 keys are shorter and faster but have less universal support.

Why does DKIM matter for deliverability?
DKIM is one of three pillars of email authentication (alongside SPF and DMARC). Without DKIM, receiving servers have no way to verify that an email was actually sent by the claimed domain, increasing the likelihood it is marked as spam or rejected.

Is this lookup private?
The only external request is a DNS-over-HTTPS query to Cloudflare. No data is stored or shared by this tool.

Can one domain have multiple DKIM records?
Yes. A domain can have multiple DKIM records using different selectors. This is common when a domain sends email through multiple providers (e.g., Google Workspace for corporate mail and SendGrid for transactional email).

Background

Verify that a domain has a valid DKIM record configured. DKIM adds a digital signature to outgoing email, allowing receiving servers to verify that a message was actually sent by the domain it claims to be from and that it has not been modified in transit.

This tool queries the TXT record at selector._domainkey.domain and parses the DKIM key record — showing the public key, key type (RSA or Ed25519), hash algorithms, flags, and any configuration warnings.

If you don't know the DKIM selector, use auto-detect mode. It scans 20+ common selectors (google, default, selector1, selector2, k1, dkim, protonmail, zoho, etc.) in parallel and reports every active DKIM record it finds.

Who is this for: email administrators setting up DKIM signing, security engineers auditing domain authentication, developers debugging email deliverability, and anyone investigating email spoofing protections.

Related tools

SPF Record Checker

Look up and validate SPF records — parse mechanisms, detect misconfigurations, and check email authentication.

DMARC Checker

Look up and analyse the DMARC record for any domain — policy, alignment, reporting, and configuration warnings.

MX Lookup

Look up MX records for any domain — mail server priority, IP addresses, and email provider detection.

DNS Lookup

Query all DNS record types for any domain — A, AAAA, MX, TXT, CNAME, NS, SOA, CAA — via Cloudflare DoH.

Learn more

network

SPF, DKIM, and DMARC Explained: Stop Emails Going to Spam

How SPF, DKIM, and DMARC work together to stop email spoofing and spam folders. Google now rejects 75% of unauthenticated email from bulk senders.

network

DNS Record Types Explained: A, AAAA, CNAME, MX, TXT

Every DNS record type explained with real dig examples. Covers A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, and CAA records used across 350M+ domains.