--- title: "DKIM Checker: Look Up DKIM Records & Selectors | Prosyo" description: "Free DKIM checker: find DKIM keys by selector or scan 40+ common selectors for Google, Microsoft and more, with key length and revocation checks." url: "https://prosyo.com/de/tools/dkim-checker/" image: "https://prosyo.com/wp-content/uploads/2026/10/cropped-Prosyo-Icon-Transparent-1.png" language: "de" --- Free Tools # DKIM Record Checker Find DKIM keys for a domain by selector, or scan the common selectors used by Google, Microsoft and popular senders. DKIM Record Checker Instant · free ## What is a DKIM checker? A DKIM checker looks up the public key a domain publishes for DomainKeys Identified Mail and tells you whether it is valid, how strong it is and whether it is still in use. DKIM adds a digital signature to every message you send. The receiving server finds your public key in DNS, at `selector._domainkey.yourdomain.com`, and uses it to confirm two things: the message really was sent by someone authorised to sign for your domain, and nobody changed it on the way. This free DKIM checker works in two ways. If you know your **selector**, enter it and the tool checks that exact key. If you do not, leave the selector empty and the tool scans more than 40 selectors used by Google Workspace, Microsoft 365, Zoho, Proton and popular sending platforms. For every key it finds, it reports the key type, the approximate key length, whether the key has been revoked and whether it is still in test mode. ## How to use the DKIM checker 1. **Enter your domain**, for example `yourcompany.com`. 2. **Add a selector if you know it**, such as `google` or `selector1`. Leave it empty to scan the common ones. 3. **Press “Check DKIM”.** A scan takes a few seconds because the tool asks for each selector separately. 4. **Read each key’s checks.** Green is a working 2048-bit (or Ed25519) key. Amber is a working but short key, or a key in test mode. Red is a revoked key. 5. **If nothing is found**, find your selector from a sent email (instructions below) and check it directly. ## How DKIM works When your mail server sends a message, it calculates a hash of the message body and selected headers (From, Subject, Date and others), encrypts that hash with your **private key**, and adds the result to the message in a `DKIM-Signature` header. That header also says which domain signed (`d=`) and which selector to use (`s=`). The receiving server reads `d=` and `s=`, looks up the TXT record at `s._domainkey.d`, takes the **public key** from it, and checks the signature. If the body or the signed headers changed in transit, or the key does not match, DKIM fails. The selector exists so one domain can have several keys at once: one per sending service, or an old and a new key during rotation. That is also why a DKIM checker needs the selector, and why scanning common names is useful when you do not know it. ## Anatomy of a DKIM record A DKIM record is a TXT record (or a CNAME pointing to one) that looks like this: `v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…` | Tag | Meaning | | --- | --- | | `v=DKIM1` | Version. Optional but conventional. | | `k=rsa` | Key type. `rsa` is the default; `ed25519` is the modern alternative. | | `p=` | The public key, base64-encoded. An empty `p=` means the key is revoked. | | `t=y` | Test mode: receivers may treat signatures as unverified. Remove it once DKIM works. | | `t=s` | Strict: the signing domain must exactly match, with no subdomains. | | `h=` | Acceptable hash algorithms, usually `sha256`. | ## Key length: why 2048 bits RSA keys of 1024 bits were standard for years and are still accepted, but they are now considered the minimum, and most providers recommend 2048 bits for new keys. The checker estimates the key length from the size of the published key. If yours shows 1024, plan a rotation: generate a 2048-bit key in your email provider, publish it under a new selector, switch signing to it, and remove the old record a week or two later. Some older DNS hosts cannot store a 2048-bit key in one TXT string because of the 255-character string limit. Good hosts split the value into several strings automatically; if yours does not, enter it as two quoted strings, or use a host that handles long records. ## Common DKIM selectors by provider | Provider | Selector(s) | Record type | | --- | --- | --- | | Google Workspace | `google` (default; can be customised) | TXT | | Microsoft 365 | `selector1`, `selector2` | CNAME to Microsoft | | Zoho Mail | Set when you create the key, often `zmail` or `zoho` | TXT | | Proton Mail | `protonmail`, `protonmail2`, `protonmail3` | CNAME | | Fastmail | `fm1`, `fm2`, `fm3` | CNAME | | Marketing and transactional platforms | Platform-specific, such as `s1`/`s2`, `k1`, `pm` or `hs1`/`hs2` | Usually CNAME | Selectors can be customised, so these are starting points rather than guarantees. The scan covers all of them. ## How to find your DKIM selector 1. Send an email from the domain to an account you can open, such as a personal Gmail address. 2. Open the message and view the original source. In Gmail: the three-dot menu, then “Show original”. In Outlook on the web: the three-dot menu, then View, then “View message source”. 3. Find the `DKIM-Signature` header. It contains `d=yourdomain.com` and `s=selectorname`. 4. Enter that selector in the checker above. If the `d=` value is not your domain (for example it is the sending platform’s domain), the message is signed, but not with your domain. It will pass DKIM yet fail DKIM alignment for DMARC. Set up custom domain authentication in that platform so it signs as you. ## How to set up DKIM ### Google Workspace 1. Admin console, Apps, Google Workspace, Gmail, Authenticate email. 2. Select the domain and Generate new record. Choose 2048-bit and keep the prefix `google` unless you need another. 3. Publish the TXT record at `google._domainkey` with the value shown. 4. Wait for DNS to update (check with this tool), then click Start authentication. ### Microsoft 365 1. Microsoft Defender portal, Email and collaboration policies, Email authentication settings, DKIM. 2. Select the domain to see the two CNAME records for `selector1._domainkey` and `selector2._domainkey`. 3. Publish both CNAMEs at your DNS host. 4. Back in Defender, enable “Sign messages for this domain with DKIM signatures”. ### Other sending services Look for “domain authentication”, “sender authentication” or “custom DKIM” in the service’s settings. You will be given one or more CNAME or TXT records to publish. Once published, verify in the service and check here. ## Common DKIM problems ### Key published but signing not switched on The most common Google Workspace mistake: the record is in DNS, the checker finds it, but nobody clicked Start authentication. Messages go out unsigned. Check a sent email’s headers for a `DKIM-Signature` with your domain. ### Record in the wrong place The host must be `selector._domainkey`. Some DNS editors append the domain automatically, so typing the full name creates `google._domainkey.yourdomain.com.yourdomain.com`. The checker will not find it there. ### Broken key from copy-paste Line breaks, missing characters or stray quotation marks corrupt the key. Copy the value again from your provider in one piece. ### Test mode left on `t=y` tells receivers the domain is testing DKIM. Remove it once signatures verify. ### Body changed after signing Mailing lists, some security gateways and footer-adding systems modify messages after they are signed, which breaks DKIM. This is outside your control for forwarded mail; for your own systems, make sure nothing edits messages after the signing step. ## DKIM, DMARC and cold email For DMARC to pass, DKIM must pass **and** the signing domain must align with your visible From domain. That makes DKIM the most important single record for outbound email, because unlike SPF it survives forwarding. If you send cold email from secondary domains, every one of them needs DKIM switched on in your mailbox provider. Check them all with the [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/), then confirm the policy with the [DMARC Checker](https://prosyo.com/tools/dmarc-checker/). Outreach tools that send through your own Google or Microsoft mailbox use that mailbox’s DKIM signature, so mail is signed as your domain automatically once DKIM is enabled in the provider. Tools that send through their own servers need their own DKIM records published on your domain. ## Rotating DKIM keys Rotating keys every six to twelve months is good practice, and essential if a private key may have leaked. Selectors make rotation painless: 1. Generate a new key with a new selector name. 2. Publish the new record and confirm it with this checker. 3. Switch signing to the new selector. 4. Leave the old record in place for a week or two so messages still in transit verify. 5. Revoke the old key by publishing an empty `p=`, then delete the record later. Microsoft 365 rotates between `selector1` and `selector2` for you. ## Reading DKIM results in headers In the original message source, the receiving server records the verdict in `Authentication-Results`, for example `dkim=pass header.d=yourdomain.com header.s=google`. Other values are `fail` (signature did not verify), `neutral`, `temperror` (DNS could not be reached) and `permerror` (the record is broken). If you see `pass` but `header.d` is someone else’s domain, fix alignment as described above. ## DKIM or SPF: which matters more for cold email? Both, but DKIM carries more weight in practice. SPF checks the server that connected; it breaks when a message is forwarded and only aligns with DMARC when the envelope sender matches your From domain, which many sending platforms do not do by default. DKIM checks a signature that travels with the message, survives most forwarding, and aligns as soon as the service signs with your domain. When people say “my emails pass SPF but still fail DMARC”, the missing piece is almost always DKIM alignment. ## Checking DKIM for every tool that sends as you Most companies send email from more systems than they realise. For each one, confirm it signs with your domain: | System | How it usually signs | What to check | | --- | --- | --- | | Mailbox provider (Google, Microsoft, Zoho) | Your domain, after you enable DKIM | Key found here; signing switched on in the admin console | | Outreach tools sending through your mailbox | Your mailbox provider’s signature | Nothing extra; covered by the provider | | Marketing platforms | Their own domain until you authenticate yours | Domain authentication completed; their selector found here | | Help desk, CRM, billing | Varies | A d= of your domain in a test email’s headers | | Website forms | Often unsigned | Route through an authenticated mail service | The fastest audit is to trigger one email from each system to your own inbox and read the `DKIM-Signature` and `Authentication-Results` headers. DMARC aggregate reports show the same thing across all your mail; see the [DMARC Checker](https://prosyo.com/tools/dmarc-checker/) for how to read them. ## DKIM for new outreach domains: a checklist 1. Create the mailboxes in Google Workspace or Microsoft 365. 2. Generate a 2048-bit DKIM key (Google) or publish the two CNAMEs (Microsoft). 3. Confirm the key here with the right selector. 4. Turn signing on in the admin console. 5. Send a test email to an outside inbox and confirm `dkim=pass` with your domain. 6. Publish DMARC, then run the full [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/) before warm-up. ## Worked example A team sets up `getacme.com` on Google Workspace for outreach. They run the checker with no selector and get “No DKIM key at 41 common selectors”. In the Admin console they find DKIM shows “Not authenticating”: the key was never generated. They generate a 2048-bit key with the prefix `google`, publish the TXT record at `google._domainkey`, rerun the checker and see “google: 2048-bit RSA key”. They click Start authentication, send a test email to a personal Gmail address, and the original message shows `dkim=pass header.d=getacme.com` and `dmarc=pass`. Total time: about fifteen minutes, mostly waiting for DNS. ## DKIM and email security gateways Some corporate gateways add banners, rewrite links or append disclaimers to incoming mail. If they do this after receiving your message, your DKIM signature can no longer verify downstream, which is one reason DMARC failure reports sometimes show your own mail failing at certain recipients. There is nothing to fix on your side in that case; receivers that use such gateways usually account for it. ## Glossary - **Selector**: the name that locates a specific DKIM key, as in `selector._domainkey.domain`. - **Signing domain (d=)**: the domain that claims responsibility for the message. - **Public key / private key**: the pair used to sign and verify; only the public key goes in DNS. - **Revoked key**: a record with an empty p= tag; signatures with it fail. - **Ed25519**: a modern elliptic-curve key type, shorter than RSA, supported by many receivers alongside RSA. ## How Prosyo helps Prosyo sends LinkedIn and email outreach from your own connected mailboxes, so every email carries your domain’s DKIM signature and aligns with DMARC. It verifies contacts first, sends inside safe daily limits and stops on reply. [Start a 7-day free trial](https://prosyo.com/pricing/), no card required. ## Related free tools These tools are often used together with the DKIM Checker. All of them are free, and the checkers and calculators run instantly in your browser. - [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/): Score your sending domain on MX, SPF, DKIM, DMARC, BIMI, MTA-STS and blocklists in one click, with a fix for everything that fails. - [DMARC Checker](https://prosyo.com/tools/dmarc-checker/): Read your DMARC policy in plain English, get a grade from A to F and a safe path to full enforcement. - [SPF Checker](https://prosyo.com/tools/spf-checker/): Validate your SPF record, count its DNS lookups against the limit of 10 and see every include it depends on. - [DNS Lookup](https://prosyo.com/tools/dns-lookup/): Query A, AAAA, CNAME, MX, TXT, NS, SOA and CAA records for any name from a public resolver. ## Frequently asked questions ### How do I check if DKIM is set up for my domain? Enter your domain in the DKIM checker above and leave the selector empty. It scans more than 40 common selectors and reports every key it finds. For certainty, check the DKIM-Signature header in an email you sent. ### What is a DKIM selector? A name that tells receivers where to find the right public key, so a domain can have several DKIM keys at once. Google Workspace uses google by default; Microsoft 365 uses selector1 and selector2. ### Why can the checker not find my DKIM record? Either your provider uses a custom selector, the record is published at the wrong host name, or DKIM has not been set up. Find s= in the DKIM-Signature header of a sent email and check that selector directly. ### Should my DKIM key be 1024 or 2048 bits? 2048 bits. 1024-bit keys still work but are now considered the minimum, and most providers recommend 2048 for new keys. ### Is DKIM required for cold email? Yes. Gmail, Yahoo and Microsoft expect DKIM from anyone sending at volume, and DKIM alignment is what lets DMARC pass reliably, including when messages are forwarded. ### What does an empty p= tag mean? The key has been revoked. Messages signed with that selector will fail DKIM. Publish a new key under a new selector and switch signing to it. ### Can I have more than one DKIM key? Yes. Each sending service can sign with its own selector, and you can publish a new key alongside the old one during rotation. Receivers use whichever selector the message’s signature names. ### Do I need DKIM on every domain I send from? Yes. DKIM is per domain. Every secondary domain used for outreach needs its own key published and signing switched on in your email provider. ### Is this DKIM checker free? Yes, with no sign-up. It runs in your browser using public DNS-over-HTTPS resolvers and stores nothing. ## Ready to Accelerate Your Growth? Launch smarter campaigns, convert more leads, and scale your business with ease — all in one place. [Get Started Now](https://prosyo.com/de/) [Book a Demo](https://prosyo.com/de/pricing/)