Email authentication

DKIM Record Checker

Check and validate a DKIM record for any domain and selector. Verify the public key, estimate key size, and detect revoked or test-mode keys — free, using live DNS.

Check a DKIM record

Enter a domain and selector to fetch and validate its DKIM public key.

What this DKIM record checker does

Fetches the DKIM record at selector._domainkey over DoH
Validates the v=DKIM1 syntax and public key
Estimates the RSA key size and flags 1024-bit keys
Detects revoked keys (empty p=) and testing mode (t=y)
Shows the full published record
Explains fixes in plain English with AI

Common use cases

  1. 1Confirming DKIM is published for a selector
  2. 2Diagnosing DKIM verification failures
  3. 3Checking key strength before enforcing DMARC
  4. 4Verifying a record after DNS changes
  5. 5Auditing a provider's DKIM setup
  6. 6Spotting a revoked or test-mode key

Related tools

DKIM selector finderDKIM key generatorSPF Record CheckerDMARC Record CheckerEmail Authentication AnalyzerEmail Header Analyzer

About DKIM records

A DKIM record is a DNS TXT record at selector._domainkey.yourdomain.com holding the public key receivers use to verify your signed mail. A valid record starts with v=DKIM1 and contains a p= public key. An empty p= means the key is revoked, and t=y marks testing mode where failures are ignored.

Use 2048-bit keys, remove testing mode once verified, and rotate keys periodically with new selectors. DKIM works alongside SPF and DMARC — all three should pass and align for the best deliverability.

More Free Tools Where This Came From

This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.

See All ToolsTalk to Our Team

HostCloud.in  ·  Pune, India  ·  Serving 34,987+ Websites Since 2020

FREQUENTLY ASKED QUESTIONS

Got Questions? We Have Answers.

What does the DKIM record checker validate?

It fetches the record at selector._domainkey.yourdomain.com, confirms the v=DKIM1 syntax and p= public key, estimates the RSA key size, and flags revoked keys and testing mode.

Where do I find my selector?

Read the s= tag in the DKIM-Signature header of any message you sent, or use the DKIM Selector Finder to probe common selectors.

What does an empty p= mean?

An empty public key means the DKIM key is revoked. Receivers will treat DKIM as failed for that selector until you publish a valid key.

Is a 1024-bit DKIM key still safe?

1024-bit is legacy and weaker than modern standards. Rotate to a 2048-bit key, which most providers and receivers now expect.

What is DKIM testing mode?

The t=y flag marks a record as testing, so receivers ignore DKIM failures. Remove it once you have confirmed signing works.

Does this use my live DNS record?

Yes. The record is resolved over DNS-over-HTTPS at the moment you run the check — no sample data.