netlupaCheck a domain's DKIM key
DKIM signs every email so the receiver can check nobody else sent it. Enter the domain and, if you know it, its selector.
How DKIM works
The sending server signs the message with a private key and adds the DKIM-Signature header. The receiver reads the domain (d=) and selector (s=) from that header, looks up the TXT record selector._domainkey.domain and checks the signature with the public key it finds there.
The selector allows several keys at once: one per provider, or a new one when you rotate the old key. That is why there is no way to list every key of a domain: you have to know the selector. If you do not enter one, the tool tries those of the most common providers.
The key must be RSA of at least 1024 bits (2048 recommended) or Ed25519. An empty key (p=) means the selector has been revoked.
Each record in detail
Frequently asked questions
How often should I change my DKIM key?
Rotating it at least once a year is recommended: publish the new key under another selector first, switch signing over and retire the old one a few days later.
Why does my 2048-bit key not fit in DNS?
A TXT string holds at most 255 characters, but a record can contain several strings in a row. Modern DNS panels split them automatically; if yours does not, break the key into quoted chunks.
What is my DKIM selector?
Open an email you sent, view its source or original headers and look for DKIM-Signature: the «s=» value is the selector and «d=» the domain. Google Workspace usually uses «google» and Microsoft 365 «selector1» and «selector2».
Is «~all» or «-all» better?
With DMARC in place the practical difference is small, because the DMARC policy decides. «-all» is stricter; «~all» is more forgiving with forwarding and forgotten services. Without DMARC, «-all» protects more.
I changed my DNS and the tool does not see it. Why?
DNS records are cached for as long as their TTL says (often one hour). Wait that long and check again. Also make sure the record is on the right name (for example, _dmarc.yourdomain.com for DMARC).
Do I need SPF and DMARC on a domain that sends no email?
Yes, it is highly recommended: publish «v=spf1 -all» and «v=DMARC1; p=reject;» so nobody can use that domain to send fake emails.
Do you store the domains I check?
No. We query public DNS at that moment, with our own resolver, and store neither the domain nor the result.