DKIM Lookup
Look up and analyze a domain's DKIM key record by selector.
What is DKIM Lookup?
DomainKeys Identified Mail (DKIM) is an email authentication method that attaches a cryptographic signature to outgoing messages, allowing receivers to verify the message was not altered in transit. The sending mail server signs each message with a private key and publishes the matching public key as a DNS TXT record at <selector>._domainkey.<domain>, where the selector is a label chosen by the email service. Receiving servers retrieve that public key and check it against the signature in the message header. Unlike SPF, which authorizes senders by IP address, DKIM verifies message integrity and origin with cryptography, and its signatures survive forwarding through intermediate mail servers.
How to Use DKIM Lookup
- Type the domain and, if you know it, the DKIM selector (the value your mail provider assigns — check your provider's setup docs or an email's DKIM-Signature header for "s=").
- If you don't know the selector, click "Try common selectors" to check a handful of frequently used names at once.
- Click "Look up" to query <selector>._domainkey.<domain> and parse the result.
- The key type, whether a usable public key is present, and any revocation/testing flags are explained in plain language.
Examples
Valid key
Input: selector: google, domain: example.com
Output: v=DKIM1; k=rsa; p=... — key type rsa, public key present
Revoked key
Input: v=DKIM1; k=rsa; p=
Output: Warning: empty p= tag means this key has been revoked
Common Mistakes
- Assuming DKIM "not found" means email authentication isn't set up at all — it might just mean you guessed the wrong selector.
- Publishing a DKIM record but never rotating the key, or leaving old, unused selectors active indefinitely.
- Confusing the selector with the domain — the selector is the subdomain label right before _domainkey, not part of the domain you're sending from.
Why Use This Tool
- Parses the actual DKIM key record and explains key type, presence, and revocation status, not just whether a TXT record exists.
- "Try common selectors" saves manually guessing one at a time for typical setups.
- Runs the lookup server-side via DNS-over-HTTPS, consistent regardless of your own network's DNS behavior.
- No sign-up, no rate-limited third-party dashboard — a plain, fast, one-off check.