DKIM checker

Find the key,
even without the selector.

A DKIM checker looks up the public key your domain publishes at selector._domainkey.yourdomain.com and tells you whether receiving servers can use it. Type your domain and, if you know it, the selector. If you don’t, it tries 15 names, the ones providers document plus a few generic guesses, or reads the selector from the header of an email you paste.

It runs in your browser. The domain and selector you check go to public DNS, Google’s first and Cloudflare’s if Google’s does not answer, and never to us. DKIM works together with SPF and DMARC: the SPF record generator and the DMARC record generator build the other two, and the setup guide shows how all three fit.

RFC 6376 15 selectors · key length Checked 7 Nov 2026

Published 7 November 2026 By the Builderify team

DKIM checker Reads public DNS from your browser

The TXT record’s value

Nothing is looked up in this mode. Paste the value your DNS host shows, with or without the quotes around it.

Example results · nothing has been looked up yet

Valid google._domainkey.yourbrand.com

Valid DKIM key, 2048 bits

Sample: a 2048-bit key made for this page

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1TnQhw0g56jeeN54lWXnP4JsM1MiMpxBG2/XoAJ0LIqtStWwp1/PvtHTJo95A8b8WoCOLq3tEJv/PD4Ku2d8zuNOmw1VqAHD6taYcdCJs2Z8DQFIjn1Z+/mzsktOk6C6UC0e4tn6J6RUZzT4bFp9rTfY200vc8z8kn4GaPBci+FQl4JCFc4EDlEnhIW1lBQ/Sf2hfbRa8p5TimY3NvXB8rTg3lR73CzLIF/ZDk85Sb0O56erJIhgWmokGb7cbHlajXbX28ULZ1OnIpA+veHkna18ScFf7f6Jx+CC0PjVxRvUl58r3+ccROjGPU/szOTzbNpKsRXemucsv8cwZautdQIDAQAB

Version: DKIM1
Key type: RSA
Key length: 2048 bits
Flags: none
Hash algorithms: any
Service: all

i A key of 2048 bits meets RFC 8301’s recommendation of at least 2048.

Warning test._domainkey.football.example.com

Valid, but short: 1024 bits

Sample: the 1024-bit record in RFC 8463, Appendix A.2

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkHlOQoBTzWRiGs5V6NpP3idY6Wk08a5qhdR6wy5bdOKb2jLQiY/J16JYi0Qvx/byYzCNb3W91y3FutACDfzwQ/BC/e/8uBsCR+yz1Lxj+PL6lHvqMKrM3rG4hstT5QjvHO9PzoxZyVYLzBfO2EeC3Ip3G+2kryOTIKT+l/K4w3QIDAQAB

Version: DKIM1
Key type: RSA
Key length: 1024 bits
Flags: none
Hash algorithms: any
Service: all

! RFC 8301 requires at least 1024 bits and says signers should use at least 2048. Google Workspace offers 2048 bits wherever your DNS host accepts a record that long, and 1024 where it does not.

Also tried, with nothing published: . What that means.

Answered by . DNS answers are cached, so a record you published a few minutes ago may not show yet.

Pasted record

The checker reads a record; it cannot send a test message. To see DKIM pass or fail on real mail, read the Authentication-Results header, as chapter 01 shows.

01 / Find your selector

How to find your
DKIM selector.

The selector is the first part of the DNS name that holds your key. RFC 6376 says selectors exist so one domain can have several keys at once, and its examples include office names, signing dates and individual users, so there is no one name to guess for every domain. The reliable source is a message your domain actually sent.

RFC 6376, section 3.6.2.1’s own example

DKIM-Signature: v=1; … d=example.com; s=foo.bar; …

TXT lookup: foo.bar._domainkey.example.com

d= is the signing domain and s= the selector. A message can carry several signatures, from the same or different organisations, per the RFC’s introduction: the one whose d= is your own domain is yours.

01Send a message from your domain

Send one from the address you want to check to a Gmail address that is not yours. Google’s DKIM page says you cannot verify DKIM by sending a test message to yourself.

02Open the original

In Gmail, open the message, click More next to Reply, then Show original. Google’s page gives the same path. Other mail apps have a similar “view source” or “show headers” command.

03Find the DKIM-Signature header

Look for a line starting DKIM-Signature:. Its s= value is the selector and its d= value is the domain. Google says the same: find the s value in the header.

04Paste it into the checker

Open “Have an email’s headers?” in the checker above and paste the header, or the whole block. It reads d= and s= from every DKIM-Signature it finds and looks each one up.

05Read the result

A valid key of 2048 bits is the aim, and the card says what to change when it is not. If your message carried more than one signature, check each: the d= of each says whose it is.

From RFC 6376 (sections 3.1 and 3.6.2.1) and Google’s DKIM page, read on 7 November 2026.

02 / Where providers put it

The selectors the big
senders document.

Some providers name their selectors in their help pages. The checker tries these first. Where a page does not say something, the table says so rather than guessing.

DKIM selectors and record types documented by Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES and Builderify
Service	Selector	Record	Key length stated	Source
Google Workspace	The default prefix selector is `google`. Google says to enter a different prefix if your domain already uses a key called google.	TXT, `v=DKIM1; k=rsa; p=…`	2048 or 1024 (2048 where your DNS host accepts it)	Set up DKIM
Microsoft 365	`selector1` and `selector2`, the same for every organisation.	Two CNAME records, each pointing to a key Microsoft hosts	Not stated on the page read	Use DKIM for email in your custom domain
SendGrid	`s1` and `s2` with automated security on. With it off, one TXT record, and its example uses a different selector (`m1`). You can also choose a custom selector of three characters.	CNAME (automated security on) or TXT (off)	Not stated on the page read	Configure domain authentication
Mailchimp	Two CNAME records for DKIM. Its help page names `k2._domainkey` in its troubleshooting example; it does not list the selectors in text.	CNAME	Not stated on the page read	Set up email domain authentication
Amazon SES	Easy DKIM: three CNAME records that you copy from the SES console. With your own key (BYODKIM) you choose the selector name.	CNAME (Easy DKIM) or TXT (own key)	Easy DKIM 2048 by default, 1024 optional; own key 1024 to 2048	Creating and verifying identities in Amazon SES
Builderify Broadcast	`bldrfy1`	One CNAME at `bldrfy1._domainkey` on your domain	Held on our side	Our setup guide

Every page in the table was opened on 7 November 2026. The checker also tries 8 generic names that no provider page documents, k1, k3, default, dkim, mail, smtp, key1, key2, and marks nothing as theirs.

03 / Read the result

What the checker says,
and what to do about it.

Each card quotes the rule behind its verdict. These are the six outcomes you will meet.

Key length

RFC 8301 says signers must use RSA keys of at least 1024 bits and should use at least 2048, and that verifiers must be able to check keys from 1024 to 4096 bits. Under 1024 bits is not valid. At 1024 the checker warns, because the key works but is the short end. The same RFC explains why 1024 is so common: widely used DNS software handles one 256-octet string per TXT record, and longer RSA keys do not fit in it.

p= is empty

RFC 6376 says an empty p= means the key has been revoked, and that a verifier must fail signatures that use it. A record that has been removed gives the same result. Seeing this on a selector you still send with explains DKIM failing.

t=y, still testing

The t=y flag says the domain is testing DKIM. RFC 6376 says receivers must not treat mail from a signer in testing mode differently from unsigned mail, even when the signature fails. It is meant to be removed once signing works.

Not a DKIM record

RFC 6376 says a record that begins with a v= tag other than DKIM1 must be discarded. If it starts v=spf1, an SPF record is answering at the DKIM name: your DNS host may be returning one TXT record for every name that has none of its own (a wildcard).

Published as a CNAME

Not a fault. Microsoft 365 has you publish CNAME records at selector1 and selector2, SendGrid does the same with automated security on, and the key is hosted by the provider. The checker follows the CNAME and reads the TXT record it points to.

Several records at one name

RFC 6376 says TXT records must be unique for a selector name and that results are undefined when an RRset has several. If the checker reports more than one, keep the one your sender gave you and delete the rest.

From RFC 6376, RFC 8301, RFC 8463, Microsoft Learn and SendGrid’s docs, read on 7 November 2026.

04 / Nothing found?

Why the checker says
“not found.”

Finding no key at the usual names does not mean DKIM is off: your sender may use a name the checker has no way to guess. A normal DNS lookup needs the exact name, so work through these in order, starting with the selector from a real header.

If DKIM is set up but mail still lands in spam, the guide to business emails going to spam ranks the other causes, and the setup guide walks through all three records.

01Use the selector from a real message

Read s= and d= from a DKIM-Signature header, as chapter 01 shows. A guessed selector that finds nothing proves nothing; the real one either has a record or it does not.

02Look at the host you typed

Mailchimp’s page warns that a DNS host may add your domain for you, so typing k2._domainkey.example.com can save k2._domainkey.example.com.example.com. SendGrid warns the same about its records. Enter only the part before your domain, then read the name your host shows after saving.

03Give DNS time

Google says a new DKIM key can take up to 48 hours to start working; Mailchimp and SendGrid also give 48 hours for their records. Resolvers cache answers, so a record you added minutes ago may not show yet.

04Turn signing on at your provider

Publishing the record is half of it. In Google Workspace you generate the key, add it to DNS, then click Start authentication in the Admin console. Check the same step with your own sender.

05Check the record length

Some DNS hosts limit how long a TXT value can be, and Google’s page points to its own note on this. RFC 8301 says widely used DNS software handles one 256-octet string per TXT record and that RSA keys much longer than 1024 bits do not fit in it. If your host cut the value off, the checker reports a key it cannot read.

06Make sure the record is on the right domain

The key sits on the d= domain of the signature. RFC 6376 calls that the signing domain, so a signature made by a sending service can name the service’s domain instead of yours. Check the key where d= says it is.

Where does the lookup go?

Your browser asks Google Public DNS for the record, using its JSON API, and asks Cloudflare’s if that fails. Nothing goes to Builderify’s servers, but those resolvers see the names you ask about, as any DNS resolver would. To keep a domain to yourself, use the “Paste a record” tab, which looks nothing up.

Sending newsletters from Builderify?

Broadcast and Sequences send from your own domain. Their DKIM record is one CNAME at bldrfy1._domainkey, listed on the Domains page with a Check DNS now button, and this checker tries bldrfy1 too. Sending costs 0.5 credit per email, and the 250 free credits every month cover 500 emails. See pricing.

Questions

DKIM checks, before you ask.

Read it from a message your domain sent. In Gmail, open the message, click More next to Reply, then Show original, and find the s= value in the DKIM-Signature header, as Google's DKIM help page describes. Paste the header into the checker and it reads d= and s= for you. With no message to hand, the checker tries 15 selector names, but a domain can use any name, so finding nothing at those does not prove DKIM is off.

The first part of the DNS name that holds your key. RFC 6376 says a signature's s= tag names the selector and its d= tag names the domain, so the key is looked up at selector._domainkey.domain. Selectors let one domain have several keys at once, for example one for each service that sends as it.

RFC 8301 says signers must use RSA keys of at least 1024 bits and should use at least 2048, and that verifiers must not treat a signature made with a key under 1024 bits as valid. Google Workspace offers 2048 and 1024 and says to choose 2048 if your DNS host supports it. The checker shows a 1024-bit key as valid with a warning, and a shorter one as a problem.

No. Microsoft 365 has you publish two CNAME records, selector1 and selector2, and SendGrid does the same with its automated security on, because the provider hosts the key and can change it for you. The checker follows the CNAME and reads the TXT record it points to.

The usual causes are a selector the checker did not guess, the record added at the wrong host name (some DNS hosts append your domain to what you type), DNS that has not caught up (Google says up to 48 hours), and signing that was never switched on at the provider. Read s= and d= from a real message header and check that exact name.

No. Your browser asks Google Public DNS for the record, and Cloudflare's resolver if Google's does not answer, so nothing reaches Builderify's servers. Those resolvers do see the names you ask about, as any DNS resolver would. The Paste a record tab looks nothing up, so use it to keep a domain private.

Sources

Every page above was opened on 7 November 2026. The sample 2048-bit record in the checker is a key made for this page, not anyone’s live key. ← All free tools

All deliverability guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does