What is a DKIM record?

A DKIM record is a TXT record holding the public key used to verify signatures on your outgoing mail. It is published at selector._domainkey.yourdomain.com, and receiving servers use it to confirm a message really came from your domain and was not altered.

What is a DKIM selector?

A selector names one key among several, which lets a domain sign mail through multiple providers at once. It forms part of the record name and is included in the signature header of every message, so receivers know which key to fetch.

How do I find my DKIM selector?

Look at the DKIM-Signature header of a message you sent; the s= value is the selector. Otherwise check your provider documentation. Common values are google, selector1 and selector2, k1 and s1. There is no way to enumerate selectors from DNS alone.

What does an empty p= tag mean?

It means the key has been revoked, not that the value is simply missing. Receivers treat it as an explicit instruction that mail signed with this selector should fail verification. If you see it unexpectedly, the key was withdrawn at the provider.

It puts the selector in testing mode, telling receivers to ignore DKIM failures for this domain. It is useful while setting things up but should be removed afterwards, since leaving it in place means your signatures carry no enforcement weight.

Why does my DKIM lookup return nothing?

Usually the selector is wrong, since the record only exists at the exact selector name your provider uses. Confirm the selector from a sent message header, and check that the provider has finished publishing the key.

DKIM Record Lookup

About DKIM Record Lookup

DKIM Record Lookup fetches the public key published for a given domain and selector, and checks that it is usable. DKIM signs outgoing mail with a private key held by your mail provider, and receivers verify that signature against the public key in DNS. Because a domain can send through several providers at once, each one gets its own selector, and the record lives at selector._domainkey.yourdomain.com. That is why this lookup needs a selector as well as a domain, and why there is no way to list every DKIM record a domain has: you can only query selectors you already know. Common ones are google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp and s1 for SendGrid. The tool flags the two failure modes that look fine at a glance. An empty p= tag is not a missing value but an explicit revocation, telling receivers the key is withdrawn and any mail signed with it should fail. A t=y flag puts the selector in testing mode, which asks receivers to ignore failures, so a domain can appear to be signing correctly while its signatures carry no weight. Check alongside SPF Record Checker and DMARC Record Checker.

DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.

How to use DKIM Record Lookup

Enter a domain name (e.g. example.com, without http://).
Select a record type (A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, SRV, PTR) or an email policy check (DMARC, SPF, DKIM).
Click Lookup to see live DNS records, then copy all results with one click.

Frequently Asked Questions

What is a DKIM record?: A DKIM record is a TXT record holding the public key used to verify signatures on your outgoing mail. It is published at selector._domainkey.yourdomain.com, and receiving servers use it to confirm a message really came from your domain and was not altered.
What is a DKIM selector?: A selector names one key among several, which lets a domain sign mail through multiple providers at once. It forms part of the record name and is included in the signature header of every message, so receivers know which key to fetch.
How do I find my DKIM selector?: Look at the DKIM-Signature header of a message you sent; the s= value is the selector. Otherwise check your provider documentation. Common values are google, selector1 and selector2, k1 and s1. There is no way to enumerate selectors from DNS alone.
What does an empty p= tag mean?: It means the key has been revoked, not that the value is simply missing. Receivers treat it as an explicit instruction that mail signed with this selector should fail verification. If you see it unexpectedly, the key was withdrawn at the provider.
What does t=y do?: It puts the selector in testing mode, telling receivers to ignore DKIM failures for this domain. It is useful while setting things up but should be removed afterwards, since leaving it in place means your signatures carry no enforcement weight.
Why does my DKIM lookup return nothing?: Usually the selector is wrong, since the record only exists at the exact selector name your provider uses. Confirm the selector from a sent message header, and check that the provider has finished publishing the key.

DKIM Record Lookup

About DKIM Record Lookup

How to use DKIM Record Lookup

Frequently Asked Questions

Related Tools

Also Available As