DKIM Record Lookup

About DKIM Lookup

One DKIM key, read out of DNS and judged. A DKIM record lives at <selector>._domainkey.<domain>, and this builds that name for you — getting it wrong by hand is the usual reason a lookup comes back empty.

The selector is the awkward part. It is invented by whoever configured the mail and is published nowhere: there is no record listing a domain's selectors, and no way to enumerate them. The reliable source is the s= tag in a DKIM-Signature header on a message the domain actually sent.

Without a selector, it reads the domain's TXT records first. The SPF record is the one place a domain lists who sends as it, and each sending service signs with known selectors — Google Workspace with google, Microsoft 365 with selector1 and selector2, SendGrid with s1 and s2 — so those are checked, along with about forty common names. Every key that answers is listed with the sender it belongs to and a verdict.

The TXT records also catch a common mistake: a DKIM key published at the domain itself, or at _domainkey.<domain> with no selector in front. No verifier ever looks there, so such a key does nothing, and it is flagged. Nothing found is still not proof of no DKIM: Amazon SES and Postmark sign with random or dated selectors that cannot be guessed, and the result says so when the SPF record names them.

What is worth knowing about a key is its length and its flags. A 1024-bit key still verifies everywhere and has been the wrong answer for years — it persists mostly because some DNS hosts would not accept a longer TXT value. And t=y marks a selector as being tested, which tells receivers to treat a failed signature as though the message were unsigned: correct during setup, and quietly pointless if it is still there a year later.

Where it helps

• Builds the _domainkey name correctly, which is the commonest reason a manual lookup finds nothing.
• Reads the key size out of the record, so a 1024-bit key is visible rather than implied.
• Calls out t=y, which makes a failing signature count as no signature at all.
• Distinguishes a revoked selector — an empty p= — from one that was never there.
• Works without a selector: tries about forty that common mail services use and grades every key it finds.

Limits

• Without a selector it can only guess common names. A sender on a random or dated selector — Amazon SES, Postmark — will not be found, and nothing in DNS can list them.
• The key size is estimated from the length of the record rather than by parsing the key, which is exact for the standard sizes and approximate for anything unusual.
• It reads the published key; it cannot verify a signature, which needs the message as well.
• An empty result proves only that this name is unused.

Frequently asked questions

Can I look up DKIM without knowing the selector?

Mostly. DNS cannot list a domain's selectors, but its SPF record lists the services that send as it, and each of those signs with known selectors. Leaving the selector empty reads the SPF record, checks those selectors and about forty common ones, and reports every key that answers. A random or dated selector — Amazon SES, Postmark — still needs the s= tag from a real message.

How do I find my selector?

Send yourself a message and look at its headers. The DKIM-Signature line carries s= — that is the selector — and d=, which is the signing domain. Those two build the name this tool asks for.

Is 1024 bits still acceptable?

It verifies everywhere and it is below what anybody should be publishing now. The reason it persists is historical: some DNS providers would not accept a TXT value long enough for a 2048-bit key, so 1024 became the default and stayed. If your provider will take it, publish 2048.

The record has p= with nothing after it. Is it broken?

That is a deliberate revocation. Publishing an empty key is how a selector is retired — signatures made with it stop verifying, without the record disappearing and leaving verifiers unsure whether DNS was simply failing.

Related tools

• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature