DKIM checker
Type a domain to look for its DKIM public keys under the selectors mail services use. Free, no account.
Every record is checked in the same pass. Also: SPF record checker, DMARC checker, MX record lookup. Full domain check.
How DKIM works
The service that sends your mail signs each message with a private key. The matching public key sits in DNS, at a name made of a selector and _domainkey. The receiver reads the selector in the signature, fetches the key and checks that the message was not changed on the way.
google._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
Why a checker can say "not determined"
DNS cannot list the selectors of a domain. Each sending service picks its own name: google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, s1 and s2 for SendGrid. The checker tries the common ones. When none answers, your key may simply live under a name it did not try, so it says not determined rather than missing.
The certain way: send a message to a Gmail address, open it, choose Show original, and read the DKIM line. It names the selector and says pass or fail.
Keys that need attention
An RSA key shorter than 1024 bits is refused by several receivers; 2048 is the current default. A record with an empty p= means the key was revoked on purpose. A record split badly across TXT strings by a DNS panel usually shows up as a key that does not parse.
Questions
How do I find my DKIM selector?
Open a message you sent in Gmail, choose Show original, and look at the DKIM-Signature header: s= is the selector and d= the signing domain. Your sending service also shows it in its domain settings. The public key is then at selector._domainkey.yourdomain.com.
Can a domain have several DKIM keys?
Yes, one per selector. Each service that sends as you (your mailbox, a newsletter tool, a helpdesk) usually has its own selector and key. They do not conflict, unlike SPF records.
What DKIM key length should I use?
2048-bit RSA. 1024-bit keys still pass at most receivers but are considered weak, and some DNS panels need the 2048-bit value split into several quoted strings, which is normal.
Is DKIM enough to pass DMARC?
It is, when the d= domain of the signature matches the domain in the From line. A message signed only by the sending service under its own domain passes DKIM but does not align, and DMARC needs alignment.
Reads public DNS only. A DKIM key we cannot find is reported as not determined, never as an error. Results are kept for ten minutes.