Check DKIM selectors and public keys.

Find the right DKIM selector

DKIM publishes a signing key beneath selector._domainkey.example.com. A domain can have several selectors, and DNS does not provide an exhaustive list of them. This checker tries a bounded set of common candidates automatically.

For a more precise check, open DKIM options and enter up to three selectors. You can also paste the DKIM-Signature line from a recent outgoing message into the header helper. It extracts the signing domain (d=) and selector (s=) in your browser; the pasted header is not uploaded.

What this checker inspects

The DNS report shows the selector owner, TXT or CNAME evidence and available public-key information. It checks key format, RSA key length, Ed25519 key size and empty revoked keys. A missing common selector is informational; a missing selector you explicitly requested deserves investigation.

When a key check passes but email still fails

A readable public key does not prove a message’s DKIM signature is valid. Check a received message’s Authentication-Results header, confirm which service signed it and compare the actual signing domain and selector. Content changes in transit or a sender using an old selector can still cause verification failures.

Rotate keys through the sending provider rather than inventing a replacement TXT record. Keep the provider’s published DNS values exact. Then review DMARC alignment and the sender’s SPF record.

Technical reference: DKIM specification, RFC 6376.