Free email tool
DKIM checker
Look up a DKIM public key using your domain and selector. See the published record and review missing, revoked or malformed key findings.
Real public DNS lookup. Your selector is required.
Look up your public DKIM record.
Enter your domain and its DKIM selector to see the published record and any issues found. Results appear here after a real DNS lookup.
How to check a DKIM record
1. Find the right details
Use your provider’s DKIM settings or a sent message’s headers. Copy the signing domain and selector, not the full DNS record name.
2. Run the lookup
Enter both values. The tool checks the TXT record at selector._domainkey.domain and shows the exact DNS name queried.
3. Review and share
Read the findings and copy the report. Check with your administrator if a selector is missing or its key needs attention.
DKIM questions
What is a DKIM selector?
A selector identifies which public key to look up for a signing domain. A domain can use several selectors. The lookup name combines the selector, _domainkey and the signing domain.
Where do I find my domain and selector?
Open the original headers of a message sent through the service you want to check. In its DKIM-Signature header, d= gives the signing domain and s= gives the selector. Your email provider's DKIM settings can also provide them.
Can the tool find every DKIM selector automatically?
No. DNS does not provide a complete selector list for this check. Enter the specific selector from your provider or a sent message. A missing record for one selector says nothing about other selectors.
Does finding a public key prove DKIM works?
No. A DNS record lookup cannot verify that a service signs mail correctly or that a message's signature matches. This tool inspects published records and identifies supported key and syntax issues. It does not verify an actual email signature.
What does a revoked key mean?
A DKIM key record with an empty p= value indicates the key has been revoked. Your email administrator can check whether the service uses a different selector.
What happens to my domain and selector?
Both are sent to AskQuokka to look up the public DNS record. You do not connect a mailbox. Entered domains, selectors and returned records are not included in tool analytics.
Protocol reference: DKIM specification, RFC 6376.
DKIM selectors and provider setup
How to Find Your DKIM Selector
Find the s= selector and d= signing domain in a DKIM-Signature header, then look up that exact public key with the free checker.
Google Workspace DKIM Setup and Selector Check
Review Google Workspace DKIM setup, publish the Admin console's public key and check the actual selector. No Google connection is needed for DNS checks.
Microsoft 365 DKIM: CNAME and Selector Guide
Understand Microsoft's two DKIM selectors, copy the tenant-specific CNAME targets and check the selected signing key. Free domain and selector lookup.