Free DKIM Checker
Validate Your DKIM Record & Public Key
Validate your DKIM record, selector, public key, syntax, and key length. Run a DNS lookup or paste a record to verify before publishing.
Enter your domain and selector to check the DKIM record, or paste a DKIM record to validate without querying DNS.
About Free DKIM Record Checker by DMARKOFF
Our free DKIM checker looks up your domain's DKIM record for a given selector, validates its syntax, key strength, and algorithm, and confirms it's published correctly in DNS. When a check fails, whether it's a bad selector, invalid key length, or algorithm mismatch, you'll get the specific correction to make before you republish.
You can also paste a DKIM record directly instead of running a live DNS lookup, useful for testing a record before you publish it, or troubleshooting one your provider gave you.
Instead of waiting for delivery failures or phishing attempts to reveal problems, this tool helps you catch DKIM weaknesses early, protecting your brand from spoofing and improving inbox placement.
What is a DKIM Record?
A DKIM (DomainKeys Identified Mail) record is a TXT entry in your domain’s DNS that contains the information needed to verify your email’s authenticity.
It proves that:
· The message content (body, links, and attachments) has not been changed in transit.
· The email is original and really comes from your domain.
A DKIM record has two essential parts:
· Selector – a unique string that tells receiving mail servers which DKIM public key to use.
· Public Key – stored in your DNS, used to validate the signature.
Together with the private key (kept securely on your mail server) and the DKIM-Signature header added to each message, these form the backbone of DKIM authentication.
Example of a Valid DKIM DNS TXT Record
Below is an example of how a DKIM record may look in DNS in TXT format:
In this example:
Name – DKIM records are stored under a specialized name, not under your domain name. DKIM records have the following name format: [selector]._domainkey.[domain].
Content – This section of the DKIM DNS record contains the public key. In this example, v=DKIM1 signifies that this TXT record is meant to be read as DKIM, with the public key being all the content following p=.
Type – TXT indicates that this is a DNS TXT record.
TTL (time to live) – how long the record is cached before DNS re-checks it (usually several minutes).
How does DKIM work?
The DKIM authentication process follows four main steps:
1. Keys are created.
The domain owner creates a private key (kept secure) and a public key (published in DNS as a DKIM TXT record).
2. Email is signed.
The sending server uses the private key to create a digital signature, added to the email's header along with the domain and selector.
3. The signature is verified.
The receiving server looks up the public key in DNS and uses it to verify the signature.
4. Authentication result.
If the signature matches, the email is confirmed as authentic and unaltered. If it doesn't, the email may be flagged, sent to spam, or rejected.
What DKIM Checker Detects
With the DKIM test tool, you’ll see a clear report of your DKIM configuration:
✓ Confirms your domain exists and has valid name servers
✓ Confirms a DKIM record exists for the selector you specify
✓ Confirms only one DKIM record is published for that selector
✓ Flags unrelated TXT records at the selector's DKIM host
✓ Validates DKIM public key syntax
✓ Checks key length against modern security standards (RFC 8301 recommends 2048-bit)
✓ Confirms the DKIM key hasn't been revoked
✓ Validates the DKIM key algorithm
✓ Checks the overall record for syntax errors
When a check fails, whether it's a bad selector, invalid key length, or algorithm mismatch, you'll get the specific correction to make before you republish.
Benefits of Regular DKIM Checks
• Confirm DKIM is correctly enabled for your domain
• Catch errors introduced by DNS or mail server changes
• Validate selectors and public keys across multiple providers
• Improve deliverability by ensuring signatures can be verified
• Reduce the risk of spoofing and phishing
• Maintain DMARC compliance (DKIM is one of DMARC's two alignment paths)
Why Choose Free SPF Record Checker
Test before you publish — validate a record directly, without waiting on DNS propagation.
Free, no signup — run a check without creating an account.
Specific fixes — get the exact correction to apply, not just a pass/fail.
FAQ
A DKIM selector is a short string that directs receiving servers to the correct DKIM public key in your domain's DNS. Selectors let you manage multiple DKIM key pairs at once, useful for key rotation or when using more than one email service provider.
A DKIM lookup checks whether your domain has a valid DKIM record published for a given selector. Enter your domain and selector, and the tool retrieves the DKIM TXT record and confirms your key is correctly published and ready to authenticate outgoing email.
RFC 8301 recommends 2048-bit RSA keys for DKIM. Keys shorter than 1024 bits are cryptographically weak and rejected by modern mail receivers; even older 1024-bit keys are now discouraged in favor of 2048-bit for stronger security.
A DKIM key is considered revoked when its public key value (p=) is left empty in the DNS record. This is a standard way to invalidate a compromised or retired key without removing the DKIM record entirely; any mail signed with that selector will then fail DKIM authentication.
The DKIM-Signature header is automatically added to every email signed with DKIM. It contains the domain, selector, algorithm, and cryptographic signature. Receiving servers use this header to verify the email against the public key published in DNS.
No. DMARC only requires one of them, SPF or DKIM, to pass and align with the "From" domain. If both fail, DMARC applies your chosen policy (none, quarantine, or reject). However, implementing and aligning both SPF and DKIM is best practice, since it gives you a fallback if one method fails for a given message.
Yes, indirectly. DKIM proves your email hasn't been altered and genuinely comes from your domain, which builds trust with mailbox providers. A domain with valid DKIM signatures is seen as more reliable, and DKIM also supports DMARC alignment, strengthening your overall email authentication.
Yes. Instead of running a live DNS lookup, you can paste a DKIM record directly into the Free DKIM Checker by DMARKOFF to validate its syntax and key strength before you publish it, useful when setting up a new provider or troubleshooting a record you haven't deployed yet.