Free DKIM Record Checker: Verify Selector, Public Key & Cryptographic Alignment
Enter a domain and selector to resolve the live DKIM public key from DNS. This checker grades RSA key strength (1024-bit flagged as deprecated, sub-1024 as fail), fully supports modern ed25519 keys, detects revoked keys (empty p=), and tells you whether your key meets Google and Yahoo 2026 sender requirements.
Common selectors: default, google, s1, k1, pmta, kumo, mail
Tool Overview: What It Does & Core Purpose
DomainKeys Identified Mail (DKIM), standardized in RFC 6376, provides cryptographic verification that an email was indeed sent by the legitimate domain owner and was not altered, tampered with, or forged in transit. When your mail transfer agent (MTA) sends an email, it generates a digital signature using a private cryptographic key and injects it into the message header (DKIM-Signature).
Our Free DKIM Record Checker performs a live DNS query to verify that your public key is correctly published at selector._domainkey.yourdomain.com. It parses the public key modulus, calculates the cryptographic bit length (1024-bit vs 2048-bit), and confirms whether your record meets current authentication standards enforced by Gmail, Yahoo, and enterprise secure email gateways.
Key Advantages & Architectural Benefits
Detects Deprecated 1024-bit Keys
Google and Yahoo now flag 1024-bit RSA keys as weak. Our checker alerts you immediately if your key length falls below the 2048-bit industry standard.
Selector Syntax Verification
Accurately parses DNS TXT records at the exact selector subdomain, identifying formatting errors like missing semicolons or corrupt base64 strings.
Tamper-Proof Delivery Audit
Confirms that receiving mail servers can fetch the public key necessary to decrypt message headers and validate payload integrity.
Zero Cache Latency
Performs real-time recursive DNS lookups, allowing you to test new DKIM key deployments instantly.
Email Marketing & Cold Outreach Integration
How This Tool Accelerates Email Campaigns & Deliverability
DKIM authentication is the single most important cryptographic factor in inbox placement. Unlike SPF—which only validates the envelope IP—DKIM cryptographically binds your message content to your brand domain. This digital signature survives email forwarding through mailing lists, corporate relays, and email security gateways.
Furthermore, DMARC alignment requires that at least one authentication mechanism (DKIM or SPF) passes with the domain published in the visible From header. Having a valid, verified 2048-bit DKIM signature ensures that your cold emails and marketing blasts sail through SpamAssassin, Microsoft SmartScreen, and Google spam heuristics into the primary inbox.
Frequently Asked Questions (FAQs)
What is a DKIM selector? ▾
A selector is an arbitrary string that allows a domain to publish multiple DKIM public keys simultaneously for different servers or departments (e.g. ‘google._domainkey’, ‘mail._domainkey’, ‘pmta._domainkey’). The selector is specified in the ‘s=’ tag of the DKIM-Signature header.
How do I find my domain’s DKIM selector? ▾
You can find your selector by inspecting the raw headers of an email sent from your domain (look for ‘s=’ in the ‘DKIM-Signature’ header), or by checking your email provider’s admin console (e.g. Google Admin > Apps > Google Workspace > Gmail > Authenticate email).
Why is 2048-bit DKIM required instead of 1024-bit? ▾
Advances in computing power have made 1024-bit RSA keys theoretically breakable. In 2024–2026, major mailbox providers like Google and Yahoo updated their sender guidelines to mandate 2048-bit keys for enterprise deliverability and security.
What causes a DKIM verification failure? ▾
Common causes include truncated public keys in DNS, line breaks inserted by DNS managers, selector typos, mismatched private/public key pairs, or intermediaries modifying email body whitespace or subject lines in transit.
How does AutoSMTP automate DKIM key generation? ▾
AutoSMTP generates cryptographically secure 2048-bit RSA key pairs automatically for every provisioned sending node, installs the private key securely with 0600 permissions on your bare-metal MTA, and publishes the corresponding public key to your DNS provider via API.
The Enterprise Outbound & Authentication Playbook
Follow this 7-step engineering roadmap to configure cryptographic sender authentication, comply with 2026 bulk sender mandates, and eliminate shared relay penalties.
Free tools help you audit and optimize individual elements, but sustained enterprise email delivery requires dedicated bare-metal infrastructure. AutoSMTP replaces fragile shared relays with private bare-metal PowerMTA and KumoMTA clusters configured automatically in 15 minutes.
Turnkey Dedicated Bare-Metal Clusters
Provisions fully licensed PowerMTA/KumoMTA clusters on enterprise bare-metal with flat predictable pricing and zero third-party markups.
Automated Gas-Pedal IP Warming
Monitors Google Postmaster spam ratios (<0.10%) and real-time deferrals across clean IPv4 subnets to scale daily send limits safely.
Native FBL & Socket Interceptors
RFC 5321 in-band 550 bounce suppression + automated Yahoo/Outlook CFL ingest to protect sender score automatically.
Fully Managed DNS & Auth
Pre-configured rDNS/PTR, SPF, 2048-bit DKIM, strict DMARC, and BIMI integration synchronized across your domain portfolio.
Deploy Your Dedicated Email Infrastructure Today
Stop risking your sender reputation on shared pools. Get dedicated IPv4 subnets, custom reverse DNS, and automated deliverability engineering.
Key capabilities
- Live TXT resolution per selector
- RSA 1024/2048 grading with deprecation warnings
- ed25519 support (32-byte keys validated correctly)
- Revoked-key detection (empty p= tag)
- Common-selector memory (k1, google, default, s1…).
Frequently asked questions
What is a DKIM selector?
The label that identifies which public key a signed email used, published as selector._domainkey.yourdomain.com. Your MTA signs with a selector; this checker looks up the matching public key.
Does DKIM key size matter?
Yes. Google and Microsoft recommend 2048-bit RSA; 1024-bit keys are deprecated and weaker keys can be cracked and abused by spoofers.
What does an empty p= tag mean?
The key was revoked — receivers must fail any signature referencing it. Rotate to a fresh keypair if you see this.