What is DKIM?

DKIM (DomainKeys Identified Mail) is an email authentication method that allows the sender to digitally sign emails. The receiving server looks up the sender's public key in DNS to verify the signature and confirm the message was not altered in transit.

How It Works

DKIM records are stored as TXT records at selector._domainkey.domain. The selector is chosen by the domain owner and is included in the DKIM-Signature header of each email.

google._domainkey.example.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."

Common DKIM Selectors

google — Used by Google Workspace
default — Common default selector for many providers
s1, s2 — Used by Microsoft 365 / Exchange Online
selector1, selector2 — Also used by Microsoft 365
k1 — Used by Mailchimp
mailo — Used by Mailgun
smtp — Generic selector used by some providers

Finding Your Selector

Check the DKIM-Signature header in a received email. Look for the s= tag, which contains the selector value.

How DKIM works and how to find your selector

DKIM (DomainKeys Identified Mail) lets a mail server sign each message with a private key, while the matching public key is published in DNS so receivers can verify the signature. This tool looks up that public key from Google Public DNS.

What you need to look one up

DKIM records live at selector._domainkey.yourdomain.com. The selector is a label chosen by your email provider, and it cannot be guessed from the domain alone. Typical examples are google for Google Workspace and selector1 / selector2 for Microsoft 365, but many services use their own. You can find yours in your provider's DNS setup instructions, or in the header of a message you sent: look for DKIM-Signature: ... s=selector; d=yourdomain.com.

How to read the result

v=DKIM1 marks a DKIM record, k=rsa is the key type, and p= holds the public key. An empty p= means the key has been revoked.
2048-bit keys are the current recommendation; 1024-bit keys still work but are weaker.
Some providers publish DKIM as a CNAME that points to their own record, so your DNS panel may show a CNAME while the lookup returns the final TXT value.

Common problems

The record was added with extra quotes or line breaks by the DNS panel.
The selector in DNS does not match the selector the mail server signs with.
A long key was split incorrectly, so the value is truncated.

DKIM works with SPF and DMARC. Our DKIM setup guide walks through the full process.

DKIM Record Lookup