Unlike SPF or DMARC, a DKIM record isn't published at a single, predictable location - it lives under a selector. That is what makes DKIM lookups tricky, and what this tool automates.
How a DKIM Lookup Works
A DKIM public key is published as a TXT record at selector._domainkey.yourdomain.com. To look it up you need two things: the domain and the selector. The selector is a label chosen by whichever service signs your mail, so a single domain can have several DKIM records - one per sending service - each under a different selector.
Finding the Right Selector
The selector appears in the DKIM-Signature header of any signed message from your domain, as the s= tag. If you can open a sent message's raw headers, that's the surest way to find it. If you can't, the auto-discovery scans the selectors providers commonly use, for example:
- Google Workspace -
google - Microsoft 365 -
selector1andselector2 - SendGrid -
s1ands2 - Mailchimp -
k1
Reading a DKIM Record
A DKIM record looks like this:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...
The v=DKIM1 tag identifies it, k=rsa is the key type, and p= is the base64-encoded public key receivers use to verify signatures. An empty p= means the key has been revoked. The receiving server fetches this key, checks it against the signature on the message, and passes DKIM only if they match and the message wasn't altered in transit.
What a DKIM Check Confirms
- The key is published at the expected selector and isn't revoked.
- The key is strong enough - 2048-bit is the modern standard; 1024-bit keys should be rotated up.
- The record is well-formed, with no stray characters that would break verification.
How Do I Generate a DKIM Record?
You don't generate a DKIM record by hand - the service that sends your mail generates the key pair for you. In your provider's admin console (Google Workspace, Microsoft 365, SendGrid, Mailchimp, and the rest), enable DKIM or "email authentication" and it produces a public key plus the exact selector._domainkey host name to publish. You paste that TXT record into your DNS, the provider keeps the matching private key, and signing starts automatically. The one manual step that's easy to get wrong is confirming the record actually resolved at the right selector - which is exactly what the lookup above does. Generate the key in your provider, publish it, then run the domain and selector through this tool to verify the published key is present, well-formed, and at least 2048-bit before you rely on it.
DKIM, SPF, and DMARC Work Together
DKIM proves a message wasn't altered, SPF proves the sending server is authorized, and DMARC ties both to your visible From address and sets the enforcement policy. DMARC can pass on DKIM alignment alone, which makes a valid DKIM record a resilient second line of authentication - especially for forwarded mail, where SPF often breaks. Keep all three healthy: AutoSPF maintains the SPF side automatically, an SPF syntax validator catches record errors before receivers do, and our DKIM guide covers the rest.