What DKIM Checker does
DKIM (DomainKeys Identified Mail) signs outbound headers and body with your private key. Receivers verify with the public key in DNS.
This page only looks up the record: enter a selector, fetch selector._domainkey TXT, check that p= is set. Key generation is on DKIM Generator.
Examples
- Google
selector = googleWorkspace panel.
- Microsoft
selector1 / selector2365 defaults.
- Own MTA
s1 or mailDo not reuse provider names.
Reading the result
No record usually means a wrong selector or it is not published yet. Empty p= is an intentional revoke. CNAMEs to a provider key are common; the tool follows them.
For a new RSA pair use DKIM Generator. After publish, verify here that p= is non-empty.
Frequently asked questions
What is a DKIM selector?
The first label of the DNS name. For a rollover, publish a new selector, switch the MTA, then revoke the old key with empty p=.
What if p= is empty?
The key was revoked. New signatures will not verify. On a leak, publish empty p= first, then issue a new selector.
Where do I generate a key?
On the DKIM Generator page. This Checker only reads an existing DNS record.
Which selectors should I try?
On lookup: google, selector1, selector2, default, k1, s1, mail. For your own MTA generate s1 or mail on the Generator — do not take provider names.
Can DKIM be a CNAME?
Yes; providers CNAME selector._domainkey to their record. The tool follows CNAME. If you generated your own key, publish TXT, not CNAME.
What is t=y?
Test mode. Signatures are made but failures may not be penalised. Remove it in production.
Private key leaked?
Publish empty p= (revoke), mint a new key and selector on the Generator, update the MTA.