DKIM Checker

Built for operators & agencies
Live DNS - no cached APIs
No login required
No data retention
Privacy first diagnostics
Prevents blacklisting - not causes it

Check if your DKIM TXT record is published correctly for a domain and selector.

DKIM records live at selector._domainkey.example.com. Find the selector in DKIM-Signature: s=.

warning Emergency scan
DKIM failures often mean alignment is broken - DMARC will fail even when SPF looks fine.

What DKIM is, in plain English

DKIM is a cryptographic signature added to outgoing mail. Receivers verify that signature using a public key published in DNS at selector._domainkey.yourdomain.com.

If the key is missing, published under the wrong hostname, or damaged by the DNS UI, the receiver cannot verify it. The result is often: lower inbox placement, more spam placement, and DMARC failures even when SPF looks fine.

How to pick the right selector

  • Common selectors: google, selector1, selector2, s1, s2, fm1.
  • Best method: open a delivered email → find DKIM-Signature: → copy the s= value.
  • If you’re using an ESP, the selector is defined in that ESP’s DKIM setup screen.

What to do if DKIM is missing

  1. Enable DKIM in your ESP (Google Workspace / Microsoft 365 / Brevo / SendGrid / Mailgun / SES).
  2. Publish the DKIM TXT/CNAME exactly as provided.
  3. Re-check here, then confirm alignment with DMARC Analyzer or the full checker.