cnames.dev / tools / dkim checker
DKIM Checker
Look up a DKIM public key by selector and confirm it's published and non-empty.
What DKIM does
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail. Your mail server signs each message with a private key; receivers fetch the matching public key from DNS and verify the signature. A valid signature proves the message wasn't altered in transit and genuinely came from a server holding your key.
Where the key lives
DKIM records are published at <selector>._domainkey.<domain> as a TXT record containing v=DKIM1, an optional key type k=rsa, and the public key p=…. Because the record is selector-scoped, you can rotate keys and run multiple senders without collisions — which is why you must know the selector to look it up.
DKIM, SPF and DMARC together
DKIM is one leg of email authentication. SPF authorizes sending servers by IP; DKIM authorizes by signature; DMARC ties them to your visibleFrom domain and tells receivers what to do on failure. You want all three.
Common DKIM issues
- Wrong selector — the record only exists under the exact selector your provider signs with.
- Empty
p=— the key was revoked or not yet published. - Record split/truncated by the DNS host — long keys must be entered as a single logical TXT value.
Building a SaaS that needs custom domains? cnames.dev automates DNS, SSL, and edge routing — one API call per domain, free for 25 domains. Start free or read the docs.
Frequently asked questions
What is a DKIM selector?
A label your email provider assigns that identifies which key to use. The DKIM record lives at selector._domainkey.yourdomain.com. Providers publish the selector they sign with (e.g. google, k1, s1, dkim).
How do I find my selector?
Check a raw received email's DKIM-Signature header for the s= tag, or your email provider's DNS setup instructions. Common examples: google (Google Workspace), s1/s2 (many ESPs), k1 (Mailchimp).
What does the p= tag contain?
The public key. Receivers use it to verify the signature added by your mail server. An empty p= means the key was revoked.
Is a longer DKIM key better?
2048-bit RSA keys are the modern recommendation over 1024-bit. Most providers now default to 2048-bit.