Free DKIM Checker: Auto-Find Your Selectors

Q: The checker says my public key is revoked — what does that mean?

A record that is only 'v=DKIM1; p=' — with an empty p= value — is the DNS way to revoke a selector: signatures using it will never verify. If you did not mean to revoke it, re-publish the full record with the p= value from your mail provider's DKIM settings.

Check your DKIM record

Enter a domain below — add its DKIM selector if you know it, or leave the selector blank to auto-discover. The checker reads the live TXT record at selector._domainkey.domain over encrypted DNS and tells you whether it parses cleanly — version tag, public key decode, testing mode, and hash algorithm.

Record broken or missing? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

What the checker looks for

A TXT record at selector._domainkey.domain (for example google._domainkey.example.com) — not at the domain root. DKIM lives under the _domainkey subdomain with your selector as the hostname.
The v=DKIM1 version tag as the first term — a record without it is ignored by receiving servers.
A usable public key in p= — the base64 public key must decode to a real key (2048-bit preferred, 1024-bit still accepted everywhere). An empty p= means the selector is revoked.
No testing mode left on — t=y tells receivers they may ignore the signature. Fine during setup, a silent protection gap afterward.
A modern hash algorithm — h= should list sha256. Records listing only sha1 are deprecated and may be ignored by modern receivers.

No record found?

Build one in seconds with the Free DKIM Record Generator — it generates a key pair and writes the v=DKIM1 record for you. Publish the TXT record at selector._domainkey.yourdomain, install the private key in your mail provider's DKIM signing settings (the DNS record alone signs nothing), and re-run this checker after DNS propagates.

DKIM is one leg of the stool — it says nothing about sending identity or policy. Run the Free Email Domain Trust Checker to see where your domain stands on the full authentication set.

Verify the rest of the set

DKIM is the signing leg. Generate or verify the rest of the authentication set, free, in your browser:

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does the DKIM checker look up? The checker queries the live TXT record at selector._domainkey.domain over encrypted DNS (via DNS-over-HTTPS), finds the record starting with v=DKIM1, and reports whether the version tag is valid, whether the public key in p= decodes to a real key, whether testing mode (t=y) is set, and which hash algorithm (h=) the record lists.

How do I find my DKIM selector? Your selector comes from your mail provider's DKIM settings: Google Workspace uses "google" by default, Microsoft 365 uses "selector1" / "selector2", SendGrid uses "k1" / "k2". If you published the record yourself, the selector is the name you chose before ._domainkey. The checker looks up exactly the selector you type — or leave the field blank and the checker probes 20 common selectors to auto-discover it.

The checker says my public key is revoked — what does that mean? A record that is only "v=DKIM1; p=" — with an empty p= value — is the DNS way to revoke a selector: signatures using it will never verify. If you did not mean to revoke it, re-publish the full record with the p= value from your mail provider's DKIM settings.

What is DKIM testing mode (t=y)? t=y tells receiving servers they may ignore DKIM failures for this selector while you are still validating the setup. It is fine during a rollout, but leaving it on silently disables the protection DKIM provides — remove t=y from the record once signatures verify.

No record found — what do I do? Publish one: use the free DKIM record generator to build a v=DKIM1 TXT record with a fresh key pair, publish it as a TXT record at selector._domainkey.yourdomain, install the private key in your mail provider's DKIM signing settings (the DNS record alone signs nothing), and re-run the checker after DNS propagates (minutes to hours).

Is Your DKIM Record Actually Signing?