DKIM Record Status
Enter domain and selector to check DKIM record
🔐 DKIM Record Checker – Validate and Verify DKIM Records
Verify DomainKeys Identified Mail (DKIM) Records
What Is a DKIM Record Checker?
DomainKeys Identified Mail (DKIM) is a cryptographic authentication standard. It allows a domain to associate its name with an email message by affixing a digital "seal of approval."
Digital Signature
Every sent email contains a hidden cryptographic hash. The DKIM record in your DNS provides the "Public Key" that receiving servers use to verify that the signature was generated by the domain owner.
Proof of Identity (EEAT)
In modern email ecosystems, security is a primary authority signal (EEAT). A valid DKIM record proves to providers like Gmail that your domain is managed with professional technical oversight.
Tamper Protection
DKIM hashes the headers and body of the message. If a malicious actor tries to alter the email content while it is in transit, the signature becomes invalid, and the email is flagged as compromised.
The Business Case for DKIM Audits
Deliverability
Maximized Inbox Placement
Receiving servers view unauthenticated mail as high-risk. A verified DKIM record signals to spam filters that your communication is legitimate, significantly improving your open rates.
Security
Prevention of Spoofing
Sophisticated phishing attacks often involve impersonating brand domains. DKIM creates a barrier that unauthorized senders cannot replicate, protecting your users from fraud.
Authority
Sender Reputation Protection
When unauthenticated mail is rejected, your domain's "Sender Score" drops. Regular DKIM verification ensures your technical setup meets global provider requirements.
Compliance
2026 Legal Standards
Major email providers have unified their security mandates. Meeting the minimum bit-strength (2048-bit) for DKIM is now a mandatory requirement for business operations.
How Our DKIM Record Checker Validate
01
Authoritative Handshake
The tool executes a direct query to the DNS root servers. It looks for the TXT record published at the unique hostname provided by your [selector]._domainkey.[domain].
02
Public Key Parsing
Once found, the tool parses the p= string (Public Key). It validates the Base64 encoding and identifies the algorithm—verifying if you are using RSA or Ed25519 cryptography.
03
Syntax Audit
Finally, the tool performs a syntax check. It looks for missing semicolons, version tags, or unauthorized characters that could cause receiving mail servers to ignore your record.
Deciphering Your Record Tags
Policy Variables
- v=DKIM1: The version tag; must appear exactly like this to be valid.
- k=rsa: Specifies the key type. RSA is standard for global compatibility.
- p=[string]: Your actual Public Key—the cryptographic seal of your domain.
- s=email: The "Selector" identifier used to distinguish this specific key.
Bit-Strength Awareness
Anything under 1024-bit is now considered "Insecure." We prioritize 2048-bit keys for modern financial and data compliance.
Granularity (g=)
An optional tag that restricts the use of the key to specific email addresses or subdomains for tighter control.
Registry of Common Fixes
DKIM Error Profile
Actionable Resolution
Invalid Public Key
Often caused by hidden line breaks or extra spaces in the DNS TXT record. Fix: Re-copy the string as a single continuous line.
Missing Selector
You cannot query DKIM without the selector. Fix: Check your mail headers (s=[selector]) to identify the correct sub-host.
Double Records
Multiple DKIM records with the SAME selector create a loop. Fix: Ensure each tool uses a unique selector name.