DKIM Checker
Check whether a domain publishes DKIM public keys. The scan looks under 14 common selectors, lists the ones it finds and grades SPF, DMARC and the rest of the domain's email security.
Start a check
- DNS-Based Scan
- Non-Intrusive Analysis
What is a DKIM record?
DKIM (DomainKeys Identified Mail) lets a mail service sign each message it sends. The public key that verifies the signature is a DNS TXT record at the selector, then _domainkey, then the domain, for example selector1._domainkey.example.com. The selector is a name chosen by whoever signs the mail, so one domain can publish several keys (RFC 6376).
The selector only appears in the s= tag of a signed message's DKIM-Signature header, so a DNS check has to guess it. This checker tries 14 common selectors: google, selector1, selector2, default, dkim, mail, k1, k2, s1, s2, sig1, email, smtp and postmark. It lists the ones that publish a key and runs the full Email Security scan.
A key under any other selector is not found and is reported as missing, even when your mail is signed. The checker does not take a custom selector yet; the problems below explain how to check one yourself.
How the DKIM check scores the result
DKIM carries 15 of the 100 points in the overall email security grade.
- Key found
- If any of the 14 selectors has a TXT record containing v=DKIM1 or p=, DKIM scores 100.
- One selector only
- Still scores 100, with a suggestion to publish a second selector so you can rotate keys.
- No key found
- Scores 0 and is reported as missing, with the list of selectors that were tried.
Common DKIM problems and how to fix them
These are the results this checker reports, with the change that fixes each one.
Selector not found
Your mail service may sign with a selector outside the 14 the checker tries, so a signed domain can show as missing.
Fix: Open a message you sent, find the DKIM-Signature header and read its s= and d= tags. Then look up the key with dig, or confirm it in your mail service's admin console.
dig TXT selector1._domainkey.example.com
DKIM not set up
Each service that sends mail as your domain needs its own key published under its selector, and signing turned on in that service. Without DKIM, DMARC depends on SPF alone, which forwarding often breaks.
Fix: Turn on DKIM signing in each mail service and publish the TXT or CNAME records it gives you.
Only one selector
Replacing the key under the same selector can break verification of messages already on their way. Selectors exist so a new key can be published alongside the old one (RFC 6376, section 3.1).
Fix: Publish the new key under a second selector, switch signing to it, then remove the old record.
DKIM record tags
A DKIM key record is a list of tag=value pairs separated by semicolons.
v=DKIM1- The version. Recommended; when present it must be the first tag.
k=- The key type, rsa by default.
p=- The public key, base64-encoded. An empty value means the key has been revoked.
s= / d=- Tags in a message's DKIM-Signature header: the selector and the signing domain that tell receivers where to find the key.
Example record
selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."
Sources
More email authentication tools
- SPF CheckerLook up a domain's SPF record and its DNS lookup count.
- DMARC CheckerCheck a domain's DMARC policy and reporting address.
- BIMI CheckerCheck a BIMI record and its DMARC requirement.
- MTA-STS CheckerCheck the MTA-STS policy, its mode and TLS-RPT.
- SPF Record GeneratorBuild an SPF record and count its DNS lookups.
- DMARC Record GeneratorBuild a DMARC record with the right tags.
- Email Security AnalyzerGrade every email authentication record at once.
Beyond DNS records
These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.
Questions
DKIM checker FAQ
What does a DKIM checker do?
It looks for DKIM public keys in DNS. This one queries 14 common selectors under _domainkey for the domain, reports which ones publish a key and runs the full email security scan.Email Security AnalyzerCompare the public security checks
How do I find my DKIM selector?
Open the headers of a message you sent and find the DKIM-Signature header. Its s= tag is the selector and its d= tag is the signing domain. The public key is published at the selector, then _domainkey, then the domain.For example, s=selector1 and d=example.com mean the key is a TXT record at selector1._domainkey.example.com.About email authentication
Why does the check say DKIM is missing when my mail is signed?
Your mail service probably uses a selector the checker does not try. Only the 14 common selectors are queried, so a key under any other selector is reported as missing. Look up that selector with dig or in your mail service's admin console.About email authenticationEmail Security Analyzer
Can I enter my own DKIM selector?
Not yet. The scan behind this page tries a fixed list of common selectors. To check a custom selector, run dig TXT selector._domainkey.example.com with your own selector and domain.About email authentication
Does DKIM alone stop spoofing?
No. A DKIM signature proves which domain signed a message, not that it matches the From address people see. DMARC requires an aligned DKIM or SPF pass and tells receivers what to do when there is none.About email authenticationEmail Security Analyzer
Can I check DKIM through an API?
Yes. POST {"target":"example.com"} to https://vigilbase.com/api/v1/agent/tools/email-security/execute. The response holds the full email security result, with the DKIM analysis under result.details.records.dkim.Run a check through the public APIAPI authentication and rate limits
