Free Tool

DKIM Record Checker

DKIM is the authentication layer that Gmail trusts most. A revoked key, weak 512-bit RSA key, or missing key causes Gmail to treat your emails as unsigned, and unsigned emails from commercial senders go directly to spam. Run a DKIM record lookup on your domain and selector to check yours now.

Common selectors:

DKIM Record Lookup: Check a Selector in Seconds

This DKIM record lookup tool queries DNS for the public key published at selector._domainkey.yourdomain.com. A DKIM record lookup needs two inputs, your domain and the selector your sending service signs with, because one domain can publish several DKIM keys at once. Enter both above and press Check DKIM.

As a DKIM record validator it checks the public key, the key type, test mode (t=y) and revoked keys (an empty p= tag), which are the faults behind many signature failures.

Lookup DKIM Record by Selector

To lookup DKIM record details for a service whose selector you do not know, open a recent email from it and find the s= tag in the DKIM-Signature header. The email header analyzer shows the full header block. The common selectors listed under the form are quick guesses for Google Workspace, Microsoft 365 and Mailchimp.

DKIM is one of three records that work together. Check the other two with the SPF record checker and the DMARC record checker, scan the wider setup with the domain security scanner, or read how to verify all three in the SPF, DKIM, DMARC checker guide.

What Makes a DKIM Key Invalid — and Why It Matters

What is DKIM?

DomainKeys Identified Mail adds a cryptographic signature to your outgoing emails. Receiving servers verify this signature to confirm the email wasn't tampered with and truly came from your domain.

How do I find my DKIM selector?

Check your email headers for the s= tag in the DKIM-Signature header. Common selectors include 'google' (Google Workspace), 's1'/'s2' (Microsoft 365), 'k1' (Mailchimp), 'default', and 'selector1'/'selector2'.

What key size should I use?

Use at least 2048-bit RSA keys. 1024-bit keys are considered weak and some providers may flag them. Google Workspace uses 2048-bit by default.

What is test mode (t=y)?

When t=y is set, receiving servers should treat DKIM failures as if the message was unsigned rather than rejecting it. This is useful during initial setup but should be removed for production to ensure full DKIM enforcement.

Related Free Tools

DKIM Record Generator →SPF Record Checker →DMARC Record Checker →Deliverability Health Check →Domain Security Scanner →Email Header Analyzer →

Learn More

↗

SPF, DKIM, and DMARC Explained

Why DKIM is required for DMARC alignment to function and protect your domain.

↗

Does DMARC Failure Guarantee the Spam Folder?

Data study on authentication's impact on spam placement when DKIM fails.

Why We Built This Tool

DKIM is the authentication layer Gmail trusts most. A revoked key, weak 512-bit key, or missing key causes Gmail to treat emails as unsigned — and unsigned emails from commercial senders go straight to spam. InboxEagle monitors 2,000+ brands. This free tool checks the key on demand.

What Goes Wrong Without This

DKIM key failures are silent. An ESP may rotate keys, your DNS may not be updated, and you won't know until emails start bouncing or landing in spam. Checking quarterly is too slow — most campaigns fail in the first few sends.

Who This Tool Is For

E-commerce & DTC Brands

Teams using multiple ESPs (Klaviyo, SendGrid, Google Workspace) who need to verify DKIM keys are published and not revoked before campaigns go out.

Email Marketing Agencies

Agencies auditing client authentication setup and troubleshooting deliverability issues where DKIM signature validation is failing.

B2B SaaS & Outbound Teams

Teams sending cold outreach and transactional mail who need to verify DKIM integrity and catch key rotation issues immediately.

Frequently Asked Questions

What is DKIM?

DomainKeys Identified Mail adds a cryptographic signature to your outgoing emails. Receiving servers verify this signature to confirm the email wasn't tampered with in transit and truly came from your domain.

How do I find my DKIM selector?

Check your email headers for the 's=' tag in the DKIM-Signature header. Common selectors include 'google' (Google Workspace), 's1'/'s2' (Microsoft 365), 'k1' (Mailchimp), 'default', and 'selector1'/'selector2'.

What does a revoked DKIM key mean?

A revoked key has an empty p= tag. If your DKIM key is revoked in DNS, your emails will fail DKIM verification. This usually happens when an ESP rotates keys or when you delete a DNS record. Update your DNS immediately.

What does DKIM authentication failed mean?

DKIM authentication failed means the receiving server could not verify the DKIM signature on a message. Common causes are a public key that is missing or revoked in DNS, a selector in the signature that does not match any published record, or a message that was changed after it was signed. Look up the selector from the s= tag of the DKIM-Signature header with this checker to see which cause applies.

How do I run a DKIM test?

Enter your domain and selector in the checker above and press Check DKIM. A DKIM test of this kind confirms that a valid public key is published in DNS. It does not prove that one particular message was signed correctly, so for that, send an email to the email spam tester or paste the message headers into the email header analyzer and read the dkim= result.

Is this a free DKIM record checker?

Yes. This free DKIM record checker looks up the key published at your selector, validates the public key and flags test mode or a revoked key. It needs no account and no sign-up. You need the selector your ESP signs with, which you can read from the DKIM-Signature header of a sent message.

Do I need an InboxEagle account to use this tool?

No. This tool is completely free and requires no account or sign-up. InboxEagle provides it as a standalone resource for email marketers, developers, and agencies.

Your DKIM Key Can Be Revoked Without Warning

This checker is a free one-off look at one DKIM selector. InboxEagle's DNS monitoring checks your DKIM records every 24 hours and alerts you if one changes or disappears, and seed tests show whether a campaign lands in the inbox at Gmail, Yahoo, AOL and Outlook.

Start Free 14-Day Trial

14-day free trial · No credit card · Cancel anytime