DKIM record checker
Enter a domain and a selector. Without a selector we try the ones the large sending platforms use, and tell you which we tried.
What DKIM signs, and what it leaves alone
The sending server hashes the message body and a chosen set of headers, signs the hash with a private key, and attaches the result as a DKIM-Signature header. The receiver fetches the matching public key from DNS and checks the arithmetic.
If the math works, nothing in the signed portion changed on the way. That is a strong statement and a narrow one. Headers the sender chose not to sign are unprotected, and a signature covers the message as it left, not its truthfulness.
This is also why DKIM survives forwarding when SPF does not. Forwarding changes the sending IP, which breaks SPF immediately, but the body and signed headers usually arrive intact. A mailing list that rewrites the subject or appends a footer breaks DKIM too, which is the failure people misread as tampering.
One tag deserves attention when you read a record. A key published with t=y is in test mode, which asks receivers to treat a failure as though the message were unsigned. Plenty of domains turn that on during setup and never turn it off, and while it is set the key is decoration.
| Tag | Meaning | Typical value |
|---|---|---|
| v | Version | DKIM1 |
| k | Key type | rsa |
| p | The public key itself | A long base64 string, or empty when revoked |
| t | Flags | y for test mode, s for strict subdomain matching |
| h | Permitted hash algorithms | sha256 |
Rotating a key without breaking anything
Keys should be replaced periodically, and the selector is what makes that painless. Publish the new key under a new selector first. Let DNS propagate. Switch the sending platform to sign with the new selector. Leave the old key in place for a week or two, because mail already in transit still refers to it.
Deleting the old record too early breaks signatures on messages that were perfectly valid when they left. Revoking properly means publishing the record with an empty p= tag, which tells receivers the key is dead rather than missing.
Questions people ask
Can one domain have several DKIM keys?
Yes, and most do. Each sending platform gets its own selector, so Google Workspace, your ESP and your helpdesk each sign with a key of their own without any of them interfering.
My DKIM record is too long for my DNS provider. Now what?
A 2048-bit key exceeds the 255-character limit on a single TXT string, so it has to be split into several quoted strings inside one record. Most providers do this for you; a few need the strings entered by hand.
Does DKIM stop someone spoofing my domain?
On its own, no. Nothing forces a receiver to demand a signature. DMARC is the piece that tells receivers what to do when the From: domain does not align with a signature or an SPF pass.
Why does my mail pass DKIM at Gmail and fail on a mailing list?
The list modified the message after it was signed, usually by adding a footer or a tag in the subject. The signature is over the original bytes, so any edit invalidates it.
Signed mail to an address that never existed
Authentication proves the sender. It says nothing about the recipient, and a list full of dead addresses bounces just as hard when every message is signed.