Softonic

DKIM Checker

Step 1 / 3 Check a DKIM key

Enter the signing domain, without an email address or URL.

Next

A DKIM selector identifies the DNS name where a sending domain publishes a public key. Enter the signing domain and selector to see the TXT record currently returned by DNS. This checker distinguishes a published key from a revoked, missing, malformed, or temporarily unavailable answer. It does not test an email message or confirm that a signature passed.

How to check a DKIM selector

  1. 1

    Enter the signing domain

    Use the d= domain from a DKIM-Signature header or the domain configured in your mail provider.

  2. 2

    Enter the selector

    Use the s= value from that header or your provider settings, such as mail.

  3. 3

    Read the DNS key state

    The checker queries selector._domainkey.domain for TXT and explains the returned record.

What the lookup actually checks

DKIM uses a selector (s=) and a signing domain (d=) to find a public key. For s=mail and d=example.org, the DNS host is mail._domainkey.example.org. This tool asks the server’s DNS resolver for TXT records at that host. The domain and selector are sent to the server for the lookup. A public key at the host is evidence of DNS publication, not evidence that any particular email passed DKIM verification.

One TXT resource record can contain several quoted strings. DNS joins those strings with no extra spaces before the key is parsed. Several separate TXT resource records at the same selector are a different case: the tool reports an ambiguous answer instead of joining keys together. A DNS timeout is reported separately from an empty answer, since a failed lookup cannot establish absence.

Record observation Meaning here What to check next
Supported key in p= Public key published Verify a specific message with its full headers if you need a DKIM pass/fail result.
Empty p= Key revoked Publish a replacement and update the signing service.
No TXT answer No key returned by this resolver Recheck d= and s=, then inspect your DNS provider.
Multiple TXT records Ambiguous selector answer Remove unintended duplicate records.
Resolver failure Answer unknown for now Retry after the DNS service recovers.

The key type defaults to RSA when k= is omitted. The checker also recognizes k=ed25519 keys with a 32-byte public key. It checks supported key syntax but cannot infer signing configuration, message authenticity, inbox delivery, or DMARC alignment from the published key alone. RFC 6376 defines the selector lookup and empty-key revocation; RFC 8463 defines Ed25519 for DKIM.

Frequently Asked Questions

Read the s= tag in a DKIM-Signature header from a message sent by your service, or check that service’s DKIM setup page. The d= tag provides the signing domain. Do not paste a whole message into the domain or selector field.

No. Verifying DKIM also requires a particular message, its signature, canonicalization, and cryptographic checks. A DNS key by itself only shows what this resolver found at the selector name.

An empty p= value is a deliberate DKIM key revocation signal under RFC 6376. A signer still using that selector needs a new key and matching DNS record before messages can verify with it.

The domain and selector are sent to this site’s server. The server queries its DNS resolver for the public TXT record. No email body or full message is needed.

Related Tools

What Is My IP

See the IP address this server received for your request, its IPv4 or IPv6 family, and an approximate country when local GeoIP data is available.

IP Address Lookup

Look up any public IPv4 or IPv6 address for approximate country, region, city, coordinates, ISP, ASN, organization and timezone.

Speed Test

Run a fast, free, browser-based internet speed test. Measure your download speed in Mbps plus round-trip latency and jitter, and see whether your connection is ready for 4K streaming, gaming and video calls, no app, no signup.

DNS Lookup

Check common DNS records for a public domain or hostname. Read values, MX priority and TTL reported at lookup by our server’s recursive resolver.

Server Location Checker

Look up the country, city, ISP and ASN behind any domain. A CDN or cloud provider like Cloudflare, Fastly or Akamai usually shows up in the ASN name.

CIDR Calculator

Calculate a normalized IPv4 or IPv6 CIDR block, its first and last address, and exact address count. See IPv4 masks and point-to-point host rules.

Tool available in other languages