google._domainkey
The name: the selector google, then ._domainkey. Your DNS host adds your domain after it.
Free DKIM record lookup
DKIM Checker
Type your business domain. We look for its DKIM key where your email service puts it, and show the steps to turn signing on if we find none.
- Free, no sign-up
- Nothing you type is stored
- Also checks the other records
What a DKIM record does
DomainKeys Identified Mail (DKIM) adds a hidden signature to every email you send. Your domain publishes the matching public key in DNS, and the receiving mailbox uses it to check that the message really came from you and was not changed on the way.
The key lives at a name made of a selector, then ._domainkey, then your domain. Only your email service knows its selector: Google Workspace uses google by default, and Microsoft 365 uses selector1 and selector2. That is why a DKIM lookup needs to know where to look.
An example DKIM record (the key is shortened here)
google._domainkey TXT v=DKIM1; k=rsa; p=MIIBIjANBgkqh...
v=DKIM1; k=rsa
Marks it as a DKIM key and names the kind of key.
p=...
The public key itself, a long string your email service gives you. An empty p= means the key was turned off.
Common DKIM mistakes the checker finds
Key added but signing not turned on
In Google Workspace the key is made in the Admin console, and after you add it to DNS you still press Start authentication there. Until then, mail goes out unsigned.
Key pasted in pieces
Some DNS hosts split long text records. If the key is cut or has extra spaces or quote marks in the middle, it no longer matches. Paste it as one value.
Wrong name
Many DNS hosts add your domain to the name for you. Typing the full google._domainkey.yourbusiness.com there can make it google._domainkey.yourbusiness.com.yourbusiness.com.
Only some services sign
Each tool that sends as your domain, like a newsletter service, needs its own DKIM key. Check each one's setup help.
Questions
How do I check my DKIM record?
Type your domain in the box above, pick your email service if you know it, and press Check it. The DKIM tile shows the key we found and its selector, or the steps to turn DKIM on. Nothing you type is stored.
Why does it say DKIM is Not checked?
A DKIM key can sit under any selector name. We look in the spots your email service uses. If nothing is there, your key may still exist under another name, so we say Not checked instead of failing it.
How do I find my DKIM selector?
Open an email you sent and view its full headers (in Gmail, the three dots menu, then Show original). Find the line that starts with DKIM-Signature. The part after s= is your selector, and the part after d= is the domain that signed it.
Do I need DKIM if I already have SPF?
Gmail and Yahoo ask every sender to set up SPF or DKIM, and bulk senders to set up both. DKIM still works when a message is forwarded, where SPF often fails, so most businesses set up both.
Based on: IETF, “RFC 6376: DomainKeys Identified Mail (DKIM) Signatures” (2011); Google, “Email sender guidelines” (2024); Yahoo, “Sender Best Practices” (2024)
Check the other records
Email gets through best with all three set up. The same check covers them, and each has its own page: SPF Checker, DMARC Checker, or all three together in the SPF, DKIM and DMARC Checker.