DKIM check
DKIM needs a selector. Enter the selector from the mail header's s= (e.g. google, selector1).
Instructions, guides and related tools
Result
Diagnostic results will appear here
Related checks and services
Planning email for your own domain? Explore Google Workspace features and service terms.
What this check does
Queries the TXT at {selector}._domainkey.{domain} and reports whether a public-key record exists.
How to read the result
Use s= as the selector and d= as the domain from the received message's DKIM-Signature. Finding a public key does not verify that message's body or signature.
Glossary
- selector
- A name that lets one domain use multiple DKIM keys.
FAQ
- I don't know the selector
- Send yourself a message and read s= in the DKIM-Signature header.
Updated:
What to check next
This checks the selected public-key record and basic syntax. It does not perform full DKIM verification of the message hash, signature or key strength.
1. Read s= and d= from the same signature
For s=mail2026 and d=example.org in one DKIM-Signature, enter selector mail2026 and domain example.org. With multiple signatures, keep each s=/d= pair together.
2. Check the publication name if missing
The lookup name is mail2026._domainkey.example.org. Check whether the DNS console appends the domain automatically. Follow the sending service's choice of TXT or CNAME publication.
3. Distinguish revocation from key rotation
An empty p= revokes the key. If an old message uses that selector, inspect a newly sent message too. Coordinate rotation between the sender and DNS; never publish a private key in DNS or this form.
4. Investigate signature failures beyond DNS
Compare the receiver's dkim= result with sending logs. Message changes during forwarding or mailing-list processing, and signing with another key, cannot be diagnosed from key presence alone.
Specifications and review date
- RFC 6376 — DKIM signatures and selectors
- RFC 5863 — DKIM deployment
- Microsoft 365 — DKIM configuration and rotation
Guidance reviewed:
