Check your domain’s DKIM (DomainKeys Identified Mail) record to see whether its public authentication key is published in DNS. Enter your domain name and DKIM selector to retrieve the associated TXT record, review its settings, and identify common configuration problems.
Look up a domain's DKIM public-key DNS record using its selector. No email address or password is required. Checks published DNS data using this website's hosting resolver. A published key does not by itself prove that any message passes DKIM authentication. DNS caching and resolver availability can affect results.DKIM Record Lookup
What Is a DKIM Record?
A DKIM record is a DNS TXT record containing a public key used to verify digitally signed email messages. When an email service signs an outgoing message, the receiving mail server can retrieve the corresponding public key from DNS to check the signature.
DKIM helps recipients detect unauthorized changes to signed message content and confirms that the signature was created using a key associated with the signing domain. It does not, by itself, establish that every message from the domain is trustworthy.
How to Check a DKIM Record
- Enter your domain: Type the domain associated with your email service, such as
example.com. - Enter the DKIM selector: Use the selector configured by your email provider, such as
default,selector1, orgoogle. - Click Check DKIM Record: The tool requests the corresponding DNS record.
- Review the results: Examine the published TXT record, available DKIM tags, and any warnings.
- Correct configuration issues: If a record is missing or incorrect, check the settings supplied by your email hosting provider.
You do not need to enter an email address, mailbox password, or private signing key.
How Does DKIM Record Lookup Work?
DKIM records are normally queried using a hostname constructed from the selector and signing domain:
selector._domainkey.example.com
For example, if the domain is example.com and the selector is default, the tool checks:
default._domainkey.example.com
The tool uses the website’s hosting server to request DNS data. It looks for a DKIM TXT record and can follow a DNS CNAME alias when one is configured.
Results may depend on DNS caching and the availability of the hosting server’s DNS resolver. The lookup does not send a test email or verify the signature of an actual message.
Understanding DKIM Lookup Results
A DKIM record can contain several tags that describe its public key and supported settings.
| DKIM Tag | Meaning |
|---|---|
v=DKIM1 | DKIM key record version |
k=rsa | Public-key algorithm; RSA is the default when omitted |
p= | Public-key data used for signature verification |
h= | Acceptable hash algorithms, when specified |
s= | Service types for which the key may be used |
t= | Optional flags, including testing or strict identity restrictions |
An example of the structure is:
v=DKIM1; k=rsa; p=PUBLIC_KEY_DATA
This example is illustrative, not a working public key.
An empty p= value indicates a revoked key. A returned record containing a public key is not enough to prove that outgoing emails are correctly signed.
Common DKIM Record Problems
DKIM Record Not Found
The specified selector may not exist, the domain may be incorrect, or the DNS change may not yet be visible to the resolver.
Check the selector supplied by your email service and confirm the full DNS hostname.
Incorrect DKIM Selector
A domain can use different selectors for different services or signing-key rotations. Entering the wrong selector may return no DKIM record even when the domain uses DKIM successfully.
Invalid DKIM Public Key
Incorrect key data, missing required tags, or an improperly configured DNS entry can prevent DKIM verification.
Copy the correct record value from your email provider’s administration panel rather than manually rebuilding the public key.
DNS Changes Not Appearing
After changing a DKIM record, some DNS resolvers may continue returning cached information until the applicable caching period expires.
Check the authoritative DNS configuration and repeat the lookup later.
DKIM Record Exists but Emails Fail Authentication
A published key does not guarantee successful DKIM authentication. The outgoing email may use a different selector, have an invalid signature, or be modified after signing.
Review the DKIM-Signature and Authentication-Results headers of an actual received email for further diagnosis.
DKIM vs SPF vs DMARC
DKIM is one part of email authentication. Two related technologies are SPF and DMARC.
| Technology | Primary Purpose |
|---|---|
| DKIM | Verifies a cryptographic signature associated with an email domain |
| SPF | Checks whether the sending server is authorized under the domain’s SPF policy |
| DMARC | Defines authentication alignment requirements and domain-owner handling preferences |
These technologies complement one another. Publishing a DKIM record does not automatically configure SPF or DMARC.
Frequently Asked Questions
Is the DKIM Record Lookup tool free?
Yes. The NetTools Pakistan DKIM lookup is intended to be available without a paid account or subscription.
How do I find my DKIM selector?
Check the DKIM configuration in your email service’s administration panel. You may also find the selector in the s= field of a received message’s DKIM-Signature header.
Can a domain have multiple DKIM records?
Yes. A domain can publish different DKIM keys under separate selectors. Each selector normally identifies a distinct DNS hostname.
Does a valid DKIM record mean my emails are authenticated?
Not necessarily. The receiving server must verify the email’s actual DKIM signature using the correct public key. This lookup checks the DNS record, not individual email messages.
Can I check someone else’s public DKIM record?
Yes, provided you know the domain and selector. DKIM public keys are intentionally published in DNS. The private signing key should never be publicly shared.
Check Your DKIM Configuration
Use the DKIM Record Lookup tool above whenever you configure email authentication, change email providers, rotate signing keys, or investigate delivery and authentication problems.
NetTools Pakistan is an independent internet and network utilities website. It is not affiliated with an email provider or domain registrar.