DKIM checker: check a key, and whether it is one worth having.
A DKIM key is a public key published in DNS at selector._domainkey.yourdomain.com, which receivers use to verify the signature on your mail. A key can be published and still useless: revoked, undersized, or flagged for testing so receivers ignore its failures. This tells you which.
Nothing found is not the same as nothing there.
DKIM records do not live at a predictable name. Every one is at <selector>._domainkey.<domain>, and selectors cannot be enumerated from outside — there is no query that lists them. So a blank result here means “not at this selector”, never “this domain has no DKIM”.
The reliable way to find out which selectors a domain uses is aggregate reports: they name the signing domain and selector for mail that was sent. A checker can only confirm a selector you already suspect.
Frequently asked questions.
DKIM records live at a selector-specific name, <selector>._domainkey.yourdomain.com, and there is no DNS query that lists which selectors a domain uses. A blank result means nothing was found at the selector you tried, not that the domain has no DKIM key at all.
Check the DKIM-Signature header of a message your domain actually sent, look in your mail provider's admin settings, or read DMARC aggregate reports, which name the selector and signing domain for mail that was sent. This tool also offers quick picks for several common provider selectors.
No. The lookup runs in your browser over DNS-over-HTTPS and queries public DNS directly. Nothing about the domain or selector you check is sent to a DDMARC server.
Use RSA keys of at least 1024 bits; 2048-bit keys are the stronger current baseline, and some receivers reject anything smaller. Ed25519 keys provide equivalent security with much shorter key material where your mail platform supports them.
For the full walkthrough, see the DKIM setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
A key is one of three things that have to line up.
DKIM proves a message was not altered and came from an authorized signer. DMARC is what makes a failed signature consequential, not advisory: without it, a broken key is nobody’s problem. Aggregate reports also name the selectors signing your mail, which is the list this page cannot guess.