Email Tools

DKIM Checker

Check whether a domain has a DKIM record configured under common selectors.

Enter a domain to check for a DKIM record under common selectors.

Leave the selector blank to check a list of common selectors automatically, or enter a known selector for a precise check.

More Email Tools

View all 8

SPF Checker DMARC Checker DMARC Record Generator SMTP Connectivity Checker Email Header Analyzer Mail Server Lookup Email Security Summary

JustChecker tracks your email authentication records continuously.

What Is DKIM?

DKIM (DomainKeys Identified Mail) signs outgoing email with a private key; receivers check the signature against a public key published in DNS at selector._domainkey.yourdomain. This tool looks for DKIM keys under common selectors (such as google, default, selector1, selector2, k1 and s1), or under a selector you enter.

When to Use It

After enabling DKIM in Google Workspace, Microsoft 365 or your email service.
When DMARC reports show DKIM failures.

How to Use It

Enter the domain.
If you know your selector, enter it for an exact check.

Understanding the Result

A found record starting with v=DKIM1 and a p= public key means the key is published. Find your selector in the s= tag of the DKIM-Signature header of an email you sent.

Limitations

Selectors can be any name, so "not found" under common selectors does not prove DKIM is missing - check with your actual selector. Publishing the key does not guarantee your provider is signing mail.

Common DKIM Selectors by Email Provider

When you leave the selector empty, the checker tries the selectors below automatically. If your provider is not listed or uses a custom name, enter the selector yourself.

Provider	Usual selector
Google Workspace (Gmail)	`google`
Microsoft 365 / Outlook	`selector1`, `selector2`
Zoho Mail	the name you chose, often `zmail` or `zoho`
Mailchimp / Mandrill	`k1` (also `k2`, `k3`, `mandrill`)
SendGrid	`s1`, `s2`
Brevo (Sendinblue)	`mail`
Proton Mail	`protonmail`, `protonmail2`
Fastmail	`fm1`, `fm2`
iCloud custom domains	`sig1`
cPanel and many web hosts	`default`

Amazon SES and some other services use random selectors that cannot be guessed - find them in the email header as described below.

How to Find Your Selector

Send yourself an email from the domain.
In Gmail choose Show original; in Outlook View message source.
Find the DKIM-Signature header. The value after s= is the selector, and d= is the domain that signed the email.

DKIM Not Found? What to Check

The record was added recently - DNS changes can take up to a few hours to appear.
The record was added to the wrong name: it must be selector._domainkey.yourdomain.com, and some DNS panels add the domain automatically, giving ...yourdomain.com.yourdomain.com.
Signing is not switched on yet in the email provider's admin panel, even though the DNS record exists.
Long keys were split incorrectly: 2048-bit keys are often entered as two quoted strings in one TXT record.

DKIM works together with SPF and DMARC - check them with the SPF Checker and DMARC Checker.

Frequently Asked Questions

DKIM cryptographically signs outgoing email so the receiving server can verify the message content wasn't altered in transit and genuinely originated from a server holding your domain's private key - a stronger, tamper-evident guarantee than SPF's sender-IP-based check.

DKIM records are published at a selector-specific subdomain (e.g. selector1._domainkey.yourdomain.com) chosen by whichever email service configured it - there's no single, universal location, so checking known common selector names is the practical way to discover it.

Your email service's own DKIM setup documentation will specify its exact selector name - you can look up that specific selector's DNS record directly if it isn't among the commonly-checked ones.

Yes, and this is common when using multiple sending services (e.g. your primary email provider plus a separate marketing platform) - each service typically uses its own distinct selector, and multiple can coexist without conflict.

No - it's one authentication signal among several; sender reputation, content, and DMARC alignment all still factor into spam filtering decisions independently of a valid DKIM signature.

Both use public/private key cryptography, but DKIM signs individual email messages for authenticity verification, while an SSL certificate secures a website's HTTPS connection - entirely separate systems serving different purposes.