A DKIM record checker looks up the public key published at a given selector and confirms it is valid, well formed, and strong enough for receivers to trust. It reads the DKIM-Signature header your mail sends, finds the selector and domain, then fetches the matching TXT record in DNS to check the key type, key length, and whether DKIM aligns with your From domain for DMARC. Running a scan tells you in seconds whether your signing setup is working.
What a checker verifies
- The selector exists and returns a valid public key at selector._domainkey.yourdomain.com.
- The key type and version are correct, for example v=DKIM1 and k=rsa.
- Key strength, with 2048-bit preferred over the weaker 1024-bit.
- Whether the signing domain in d= aligns with your visible From domain for DMARC.
- That no syntax errors or truncated keys would cause verification to fail.
Why you check the selector, not the bare domain
DKIM keys do not live at the root of your domain. They live under a selector, so a plain domain lookup will not find them. You have to know which selectors your platforms use, because each mail service signs with its own. A message from your marketing tool and a message from your helpdesk may carry different selectors, and both need valid keys. A good checker inspects real message headers or lets you test each selector by name.
Reading key strength
The public key length is the main strength signal. A 1024-bit key still verifies at most receivers, but it is easier to attack and some providers now discourage it. A 2048-bit RSA key is the current recommendation. If your DNS provider limits TXT record length, split the value into quoted strings so the full key publishes correctly. A checker will warn you if a key looks truncated or weak.
Verify the whole authentication set
DKIM alone does not stop spoofing. Pair it with SPF and a DMARC policy at p=quarantine or p=reject, and confirm DKIM aligns with your From domain so DMARC can pass.
Run a free domain scan
EmailAuth runs a free domain scan that finds your active DKIM selectors, reports each key's type and strength, and shows whether DKIM is aligned for DMARC. It also checks your SPF and DMARC records in the same pass, so you see the full authentication picture rather than one piece of it. If a selector is missing, weak, or misaligned, the scan tells you exactly what to fix.
From checking to monitoring
A one-time check is a snapshot. Selectors get added when you onboard new tools, keys go stale, and a vendor can change signing without telling you. EmailAuth monitors your selectors over time, flags weak or expired keys, and alerts you when alignment breaks. Continuous monitoring keeps DKIM working as your sending stack changes.
Frequently asked questions
How do I find my DKIM selector?
Look at the DKIM-Signature header of an email you sent; the s= tag is the selector and the d= tag is the signing domain. You can also check your email platform's DNS setup instructions, which name the selector to publish. A DKIM checker can read the selector straight from a sample message header.
Why does my DKIM record not show up in a DNS lookup?
DKIM keys are published under a selector, not at your root domain, so a plain lookup of yourdomain.com will not find them. You have to query selector._domainkey.yourdomain.com with the correct selector name. If you use the wrong selector, the record will appear missing even when DKIM is set up correctly.
Is a 1024-bit DKIM key still safe?
It still verifies at most receivers, but 1024-bit keys are weaker and some providers now discourage them. The current recommendation is 2048-bit RSA. Upgrade when your DNS and sending platform support it, and a scan will flag any key that falls short.
Can a checker tell me if DKIM is aligned for DMARC?
Yes. Alignment means the signing domain in the DKIM d= tag matches your visible From domain. A DKIM checker or a full domain scan reports whether that match holds, which is what lets DKIM satisfy DMARC and let you move to an enforcement policy.
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.