DKIM Validator & Record Checker

Free tool to validate DKIM (DomainKeys Identified Mail) records and signatures. Ensure your email authentication is working correctly with RFC 6376 compliance.

Validate DKIM Record

Common selectors: default, google, k1, selector1, dkim

DNS Query:

._domainkey.

About DKIM

DKIM (DomainKeys Identified Mail) is an email authentication method defined in RFC 6376 that allows organizations to take responsibility for transmitting a message by adding cryptographic signatures to email headers.

How DKIM Works:

  1. Email server adds DKIM signature to outgoing messages
  2. Signature is created using private key
  3. Public key is published in DNS as TXT record
  4. Receiving server verifies signature using public key
  5. Verification confirms message authenticity and integrity

DKIM Record Components:

  • v=: Version (DKIM1)
  • k=: Key type (rsa, ed25519)
  • p=: Public key data
  • h=: Hash algorithms (sha1:sha256)
  • s=: Service types (*:email)
  • t=: Flags (y=testing, s=strict)

Common DKIM Selectors

Google Workspace:

google._domainkey.example.com

Microsoft 365:

selector1._domainkey.example.com
selector2._domainkey.example.com

Mailgun:

k1._domainkey.example.com

SendGrid:

s1._domainkey.example.com
s2._domainkey.example.com

Generic/Default:

default._domainkey.example.com
dkim._domainkey.example.com

DKIM Best Practices

  • Use RSA keys with minimum 2048-bit length
  • Rotate DKIM keys regularly (annually recommended)
  • Use multiple selectors for key rotation
  • Sign all outbound email messages
  • Include important headers in DKIM signature
  • Monitor DMARC reports for DKIM alignment
  • Test DKIM implementation thoroughly
  • Consider using Ed25519 keys for better performance

Troubleshooting DKIM

Common Issues:

  • DNS record not found or incorrect selector
  • Invalid key format or corrupted public key
  • Clock synchronization problems
  • Header modification by email servers
  • Key length too short (less than 2048 bits)

Solutions:

  • Verify DNS propagation and record syntax
  • Check DKIM signature headers in email source
  • Use DMARC reports to identify failures
  • Test with multiple receiving mail servers
  • Validate key pair matching