Check a DKIM public key
Inspect the key used to verify signed email
Enter the signing domain and selector to look up the published key.
- 1 Locate the record Query selector._domainkey.domain
- 2 Inspect the key Review type, size and syntax
- 3 Review findings See DNS evidence and recommendations
This tool inspects DNS keys. It does not verify an email signature.
Understand DKIM
DKIM publishes a public key in DNS for one selector. This page reads that key and its tags. It does not verify an email signature, confirm an identity, or guarantee delivery.
Frequently asked questions
What is a DKIM selector?
The selector is the s= value in a DKIM-Signature header. The public key is published at selector._domainkey.domain. A domain can publish more than one selector.
Can a domain use multiple selectors?
Yes. Each selector is a separate DNS name. Several selectors are normal. Several TXT records at the same selector are a different, ambiguous case.
Does finding a key prove email is signed?
No. A published key shows what a verifier would fetch for that selector. Checking one message also needs the signature, the signed headers, and the body hash.
What does a revoked key mean?
An empty p= tag revokes the key at that selector. A missing p= tag is an invalid record, not a revocation. This page does not say how a receiver treats mail.