Free tool

Free DKIM Record Checker

Look up your domain's DKIM public key by selector — or let us scan 10 common selectors automatically to find which one your provider uses.

What is DKIM?

DKIM (DomainKeys Identified Mail) lets your mail server cryptographically sign outgoing messages. Receiving servers verify the signature against a public key published in your DNS — proving the message hasn't been altered in transit and was actually authorized by someone with access to your domain's DNS.

Selectors — the part that confuses everyone

A single domain can have multiple DKIM keys at different DNS names ("selectors"). The full DNS path is:

<selector>._domainkey.<yourdomain>

For example, Google Workspace uses google._domainkey.yourdomain.com. Microsoft 365 uses selector1._domainkey.yourdomain.com and selector2._domainkey.yourdomain.com. Mailgun uses mx._domainkey.yourdomain.com.

Common selectors by provider

  • Google Workspace: google
  • Microsoft 365: selector1, selector2
  • Mailchimp: k1
  • SendGrid: s1, s2
  • Mailgun: mx, k1
  • Postmark: 20210112 or your custom prefix
  • Amazon SES: variable — found in your SES console

If you don't know your selector, click "Scan common selectors" — we'll try 10 popular ones for you.

Reading a DKIM record

A typical DKIM record looks like this:

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFA...

  • v=DKIM1 — version
  • k=rsa — key type (almost always RSA)
  • p=... — base64-encoded public key

Related tools

Need to run this at scale?

BounceBlocker validates emails in bulk, monitors blacklists, and tests inbox placement — all in one platform.

Start Free →