Unlike SPF or DMARC, a DKIM record isn't published at a single, predictable location - it lives under a selector. That is what makes DKIM lookups tricky, and what this tool automates.
How a DKIM Lookup Works
A DKIM public key is published as a TXT record at selector._domainkey.yourdomain.com. To look it up you need two things: the domain and the selector. The selector is a label chosen by whichever service signs your mail, so a single domain can have several DKIM records - one per sending service - each under a different selector.
Finding the Right Selector
The selector appears in the DKIM-Signature header of any signed message from your domain, as the s= tag. If you can open a sent message's raw headers, that's the surest way to find it. If you can't, the auto-discovery scans the selectors providers commonly use, for example:
- Google Workspace -
google - Microsoft 365 -
selector1andselector2 - SendGrid -
s1ands2 - Mailchimp -
k1
Reading a DKIM Record
A DKIM record looks like this:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN...
The v=DKIM1 tag identifies it, k=rsa is the key type, and p= is the base64-encoded public key receivers use to verify signatures. An empty p= means the key has been revoked. The receiving server fetches this key, checks it against the signature on the message, and passes DKIM only if they match and the message wasn't altered in transit.
What a DKIM Check Confirms
- The key is published at the expected selector and isn't revoked.
- The key is strong enough - 2048-bit is the modern standard; 1024-bit keys should be rotated up.
- The record is well-formed, with no stray characters that would break verification.
DKIM, SPF, and DMARC Work Together
DKIM proves a message wasn't altered, SPF proves the sending server is authorized, and DMARC ties both to your visible From address and sets the enforcement policy. DMARC can pass on DKIM alignment alone, which makes a valid DKIM record a resilient second line of authentication - especially for forwarded mail, where SPF often breaks. Keep all three healthy: AutoSPF maintains the SPF side automatically, and our DKIM guide covers the rest.