DKIM record checker
Leave the selector empty to scan 40+ common selectors (Google Workspace, Microsoft 365, Mailchimp, SendGrid, Amazon SES and more), or enter your own. We show each key, its size and whether it has been revoked.
Works with a domain, an email address or a website URL. Lookups run in your browser over public DNS; nothing is stored.
Checking many domains, or clients' domains?
The Email Deliverability Checker audits SPF, DKIM, DMARC, MTA-STS and BIMI for hundreds or thousands of domains at once, grades each A–F with fixes, and exports to CSV/Excel or an API. Run it on a schedule to catch broken records. $8 per 1,000 domains, no subscription.
Run the bulk checker on ApifyFAQ
What is a DKIM selector?
The name your key is published under: selector._domainkey.yourdomain.com. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and many services use their own names.
How do I find my DKIM selector?
Send yourself an email, open the original (raw) message, and find the DKIM-Signature header. The s= value is the selector and d= is the signing domain.
What key size should I use?
2048-bit RSA. 1024-bit keys still work but are considered weak, and anything smaller is rejected by many receivers.
What does "revoked" mean?
The record exists but its p= value is empty. That is how a key is retired; mail signed with it will fail DKIM.
Related free tools: Full SPF/DKIM/DMARC audit · SPF checker · DMARC checker · DKIM checker · MX lookup · Gmail/Yahoo sender rules · SPF generator · DMARC generator