Start free
ProductHow it worksPlatform tourSafety and controlsYour first 30 daysCompetitor trackingLinkedIn signalsDone for youHubSpotSalesforceSmartleadAll integrationsFounder-led salesBefore the first SDRAccount-based marketingClosed-lost reactivation
Free toolsFree ICP assessmentSandbox workspaceSPF, DKIM and DMARC checkOutbound cost calculatorB2B outbound glossaryRoast my cold emailOutlevo CommunityICP generatorCold email generatorSubject line graderEmail word checkerBlacklist checkUse it from Claude, Cursor, LovableDeveloper hubAPI reference
IntegrationsFor AI buildersPricingResources
Theme
Log inStart free

Free · no sign-up

DKIM record checker

Enter a domain and, if you know it, your DKIM selector. We read the public key live and tell you whether it is there, how big it is and whether the domain left test mode on.

What a DKIM record is

DKIM signs each message with a private key your sender holds. The matching public key sits in your DNS, so any receiver can check the signature. Because a domain can have many keys, each lives under a name called a selector: the record for selector google is a TXT record at google._domainkey.yourcompany.com.

That is why a DKIM check needs a selector. Your email provider chooses it. If you leave it blank we try twelve common ones (google, selector1, selector2, s1, s2, k1, k2, default, smtp, mail, dkim, mxvault); a key under any other name is not found until you enter it.

TagWhat it holds
v=DKIM1The version. Optional, but when present it comes first.
k=rsaThe key type. RSA is the default; some providers use ed25519.
p=MIIBIjAN…The public key, base64. An empty p= means the key has been revoked.
t=yMarks the domain as testing DKIM, so receivers may treat a failure as if there were no signature. Remove it once signing works.
s=email, h=sha256Optional limits on the services and hash the key is for. Most records omit them.

Common errors and how to fix them

  • Record at the wrong name
    The key must be published at selector._domainkey.yourdomain. A key added at the root of the domain, or under the wrong selector, is never looked up.
    Fix: Copy the host name your provider gives you exactly, including the selector.
  • The record exists but mail is not signed
    Publishing the key does nothing until the provider is told to sign. This is the usual reason a checker shows a key while Gmail's "Show original" shows DKIM failing or missing.
    Fix: Turn on DKIM signing in your mail provider's admin panel after the record has propagated.
  • Key broken in the copy
    Line breaks, stray spaces or quotation marks pasted into the value make the key unreadable. Some DNS hosts also need long values split into several quoted strings.
    Fix: Paste the value as one line; if your DNS host asks for it, follow its instructions for long TXT values.
  • A 1024-bit key
    Older setups use 1024-bit RSA keys. They still verify, but 2048 bits is the usual recommendation today. The checker shows the size, to the nearest standard length.
    Fix: Generate a 2048-bit key at your provider, publish it under a new selector, then switch signing to it.
  • Test mode left on (t=y)
    The domain is telling receivers it is still testing.
    Fix: Delete t=y from the record once a test message shows a DKIM pass.
  • Looking up the wrong selector
    Providers rotate selectors, and a domain often has several (one per sending tool). The one you check may not be the one on your mail.
    Fix: Open a message you sent, view its source, and read the s= value in the DKIM-Signature header.

Examples

Illustrative records with the key shortened. Your provider generates the real value.

Where the record lives

google._domainkey.yourcompany.com   TXT

A normal record

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…

The signature header it checks (in a sent message)

DKIM-Signature: v=1; a=rsa-sha256; d=yourcompany.com; s=google; …

Questions

How do I find my DKIM selector?
Your mail or sending provider shows it where you set DKIM up. Or open any message you sent, view its original source, and read s= in the DKIM-Signature header: that is the selector, and d= is the domain.
Do I need a different selector for each tool?
Usually each service that signs for your domain has its own, so they do not overwrite each other. Check each one by name.
Is a DKIM record enough?
No: the provider also has to sign. Send yourself a test and look for "DKIM: PASS" in the message headers, or check all four records together.
Why does the checker say no key was found when I set one up?
Either DNS has not propagated yet, the key is under a selector we did not try, or the name is wrong. Enter the selector above to look at that exact name.
Does it work with CNAME records?
Many providers publish DKIM as a CNAME that points to their own key. DNS resolves it for us, so the key at the end is what we read.

The other checks

SPF

Which servers may send as your domain.

DMARC

What receivers do with mail that fails both.

MX

Where replies to your domain are delivered.

All four at once

The full SPF, DKIM, DMARC and MX check.

Blocklist

Is a sending address on a public blocklist?

Outlevo checks this before every campaign

A mailbox without a working DKIM key does not send.

Start in the sandboxFind my buyers, free →