DKIM Lookup
Fetch a DKIM public key for a selector.
Enter a value above to run DKIM Lookup
e.g. example.com
Quick answer
DKIM Lookup fetches the public key published at <selector>._domainkey.<domain> and shows the record that receiving servers use to verify your outgoing mail's signature. If a valid key (v=DKIM1; p=...) appears, DKIM is set up for that selector; an empty or missing record means the selector is wrong or DKIM isn't configured.
DKIM Lookup fetches the public key that a domain publishes for a specific DKIM selector. DKIM (DomainKeys Identified Mail) lets a sending server sign outgoing messages with a private key; receiving servers then look up the matching public key in DNS to verify the signature and confirm the message was not altered in transit. This tool queries the TXT record at selector._domainkey.yourdomain.com so you can confirm your key is published, readable, and correctly formatted before it affects deliverability.
How it works
You supply a domain and a selector (for example google, s1, or default). The tool builds the hostname selector._domainkey.domain and requests its TXT record. A valid DKIM record contains tag-value pairs such as v=DKIM1, the key type k=rsa, and p= followed by the Base64-encoded public key. The receiving mail server uses the selector named in the message's DKIM-Signature header to find exactly this record.
How to read the results
Look for p= with a long Base64 string; that is the public key itself. An empty p= means the key was revoked. Check that k= matches your signing algorithm (usually rsa). Optional tags include t=y for testing mode and h= to restrict hash algorithms. If the record wraps across multiple quoted strings, DNS concatenates them, so the whole p= value must still be intact and unbroken.
Common problems & fixes
The most frequent issue is the wrong selector: DKIM has no fixed selector name, so you must use the exact one your provider signs with. NXDOMAIN or an empty result usually means the record was never added or lives under a different selector. Very long keys (2048-bit) sometimes get truncated when pasted into a DNS panel; split the p= value into multiple quoted strings rather than dropping characters.
Frequently asked questions
- How do I find my DKIM selector?
- Open the raw headers of an email you sent and find the DKIM-Signature line; the s= tag is the selector and d= is the signing domain. Some providers document fixed selectors (Google uses google, Microsoft 365 uses selector1 and selector2). Without the correct selector, a lookup cannot locate the key.
- Why does my DKIM record show an empty p= value?
- An empty p= tag signals a revoked key. Receivers treat a message signed with a revoked selector as failing DKIM. This happens when a key is rotated out or intentionally retired. If you did not revoke it, republish the correct public key for that selector so signatures verify again.
- Does DKIM alone stop spoofing?
- No. DKIM proves a message was signed by a key tied to the domain and was not modified, but it does not tell receivers what to do when a check fails. You need a DMARC policy that references DKIM and SPF alignment to instruct receivers to quarantine or reject unauthenticated mail.