DKIM Record Analyzer

DomainKeys Identified Mail (DKIM) lets receiving servers verify that email was authorized by the sending domain. Enter a domain and selector to look up the public key, detect weaknesses, and get a plain English breakdown of every field.

How DKIM Works

Sender signs the email. The sending mail server uses a private key to create a cryptographic signature and adds it to the email header as DKIM-Signature:.

Key is published in DNS. The domain owner publishes the matching public key as a TXT record at {selector}._domainkey.{domain}.

Receiver verifies the signature. The receiving server looks up the public key in DNS and uses it to verify the signature, confirming the email hasn't been tampered with.

DMARC uses the result. DKIM pass or fail feeds into DMARC enforcement — a failed DKIM check contributes to email being quarantined or rejected.

DNS Lookup

Domain

Selector

Common selectors