Free DKIM Record Lookup & Key Checker
Lookup DKIM public key TXT records, inspect cryptographic key length (1024 vs 2048-bit), and verify email signature authentication.
100% Free & PrivateInstant Live Results
How to Use Free DKIM Record Lookup & Key Checker
Enter your domain name (e.g. yourdomain.com) into the domain field.
Enter your DKIM selector (e.g. google, s1, selector1) into the selector field.
Click 'RUN AUDIT' to execute real-time DNS lookup for '[selector]._domainkey.[domain]'.
Inspect the public key value, cryptographic key length (2048-bit), and validity.
Free DKIM Record Lookup & Key Checker — Technical Verification Mechanics
Free DKIM Record Lookup & Key Checker performs real-time queries against public DNS over HTTPS (DoH) endpoints, RDAP/WHOIS databases, SSL Certificate Transparency logs, and RFC protocol standards.
Zero-Retention Privacy Guarantee
Queries are executed statelessly directly in your browser or edge isolate. No scan queries, target URLs, or IP logs are saved to databases.
Real-Time RFC Compliance
Validates RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC), and TLS 1.3 standards to deliver accurate diagnostic feedback.
Free DKIM Record Lookup & Key Checker — Frequently Asked Questions
What is a DKIM selector and where do I find mine?
The selector is a name (like "google" or "s1") that points to the specific DKIM key in DNS; your email provider's admin console (e.g., Google Admin, Microsoft 365 admin center) displays it during DKIM setup.
Should I use a 1024-bit or 2048-bit DKIM key?
2048-bit is now the recommended standard for stronger security; most modern email providers default to 2048-bit, and a DKIM checker will show which length your record uses.
What causes a "DKIM record not found" error?
This usually means the DNS TXT record wasn't published, the selector was entered incorrectly, or DNS changes haven't propagated yet — wait up to 24–48 hours and recheck.
Can I have multiple DKIM keys active for different services?
Yes, each sending service (e.g., your CRM, marketing platform, and primary mail provider) can have its own selector and DKIM key, all coexisting under the same domain.
How often should I rotate my DKIM keys?
Security best practice recommends rotating DKIM keys annually or whenever a service provider change occurs, to limit exposure if a key is ever compromised.
Does DKIM verify the content of my email hasn't been changed in transit?
Yes — that's DKIM's core function: cryptographically signing message content so any tampering during delivery invalidates the signature.
What is a DKIM checker used for?
It verifies that your domain's DKIM record exists, is published correctly in DNS, and that the public key matches what's used to sign your outgoing email.
How do I find my DKIM selector?
Your email service provider (Google Workspace, Microsoft 365, SendGrid, etc.) assigns a selector, usually found in your admin panel's email authentication settings; you enter it alongside your domain in a DKIM checker.
Why is my DKIM check failing?
Common causes are a missing or incorrectly formatted DNS TXT record, using the wrong selector, or DNS propagation delays after a recent change.
Does DKIM alone prevent phishing of my domain?
No — DKIM proves a message wasn't altered and came from an authorized source, but it should be paired with SPF and DMARC for full anti-spoofing protection.
How often should I check my DKIM record?
Check it whenever you add a new email sending service, and periodically thereafter, since expired or rotated DKIM keys can silently break email authentication.
Can I check DKIM records for multiple selectors at once?
Yes, if your domain uses several sending services (each with its own selector), some DKIM checkers let you verify multiple selectors in a single scan.
How do I set up DKIM for platforms like Shopify or Klaviyo?
Each platform provides its own DKIM CNAME or TXT records to add to your DNS during their email authentication setup flow — a DKIM checker then confirms they've been published and are valid correctly.
How do I check a DKIM record using command line tools?
Use 'dig TXT selector._domainkey.yourdomain.com' to view the raw record, though a dedicated checker also parses the public key and flags formatting errors automatically.
What's the most common DKIM troubleshooting mistake?
Forgetting to include the full selector prefix (selector._domainkey.domain.com) when adding the DNS record, which causes lookups to fail entirely even though the key itself is correct.
Does DKIM checking differ for domains using multiple DKIM keys simultaneously?
Yes — each key uses a distinct selector, so checking must be done per-selector; a domain can have several valid DKIM keys active at once for different services without conflict.
How is this different from MXToolbox's DKIM lookup?
Both validate the record and key format; differences usually come down to how clearly errors are explained and whether multi-selector or bulk domain checking is supported.
What is DKIM in email, explained simply?
DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing emails, allowing receiving servers to verify the message wasn't altered and genuinely came from an authorized sender for that domain.
Why does a small business using email marketing tools need DKIM specifically?
Email marketing platforms need to sign on your behalf, and without a correctly configured DKIM record, receiving servers may treat your campaigns as suspicious or unauthenticated.
Is DKIM relevant to healthcare organizations sending patient communications?
Yes, DKIM helps ensure message integrity in transit, which supports the broader expectation of secure, verifiable communication when healthcare-related correspondence is involved.
Do nonprofits sending from multiple platforms need separate DKIM keys?
Yes, each sending platform (donation processor, email newsletter tool, CRM) typically has its own DKIM selector and key, and all can coexist under the same domain without conflict.
How does DKIM protect law firms from email impersonation?
DKIM confirms message integrity and sender authorization, making it harder for attackers to convincingly forward or send emails claiming to be signed communications from the firm.
Do real estate agents need to verify DKIM setup across multiple tools (CRM, e-signature, MLS)?
Yes, agents commonly use several platforms that send email on their behalf, and each should be properly included in the domain's authentication setup to avoid deliverability or spoofing issues.
What is a DKIM record and why do I need to check it?
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to your outgoing emails. A DKIM checker validates that your domain's public key TXT record is correctly published in DNS at '[selector]._domainkey.[domain]', ensuring receiving servers can verify email integrity.
What is a DKIM selector and where do I find it?
A DKIM selector is a string that specifies which public key to query in DNS. Mail providers assign specific selectors (e.g. Google uses 'google' or '20230601', Microsoft uses 's1' or 'selector1', SendGrid uses 's1'). Enter your domain and selector to verify the public key.
What is the recommended DKIM key length (1024-bit vs 2048-bit)?
Modern email security standards require 2048-bit RSA keys. 1024-bit keys are considered legacy and vulnerable to factoring attacks. Our DKIM analyzer checks your public key length and warns if a weak key is detected.
How to check DKIM records for Google Workspace?
In Google Workspace Admin, generate your DKIM key (selector is typically 'google'). Publish the TXT record at 'google._domainkey.yourdomain.com'. Then enter 'yourdomain.com' and selector 'google' into IncogSay's DKIM checker to verify.
How does DKIM work with SPF and DMARC?
SPF verifies the sending server's IP address, DKIM cryptographically signs the message content, and DMARC requires that either SPF or DKIM passes and aligns with the 'From:' header domain.
Can I check DKIM without knowing the selector?
If you don't know your selector, send an email to yourself or check the 'Authentication-Results' or 'DKIM-Signature' header of a sent email to extract the 's=' parameter.
What causes a DKIM validation failure?
Common causes include missing or misspelled DNS TXT records, trailing semicolons/quotes, message modification by intermediary mail relays, or key length mismatch.
Is IncogSay's DKIM lookup tool free?
Yes. IncogSay provides a free DKIM checker, DKIM key validator, and signature lookup tool with real-time DoH DNS verification.