DKIM Lookup - Find Public Keys by Selector
Check a domain for DKIM public-key records using common selector names, or use a selector from an actual message or your email provider. Review the published key record and troubleshooting guidance. Finding a public key does not verify the DKIM signature on a specific email.
Takes ~10 seconds
What This Tool Checks
Selector lookup
Checks common selector names. A miss does not prove DKIM is absent.
Key Length
Checks 1024-bit vs 2048-bit keys
Published key record
Shows the TXT record found. It does not verify a message signature.
Provider detection
Not assessed by this check
How to Fix Common Issues
No key found for the selectors checked
Check that the selector and signing domain are correct. Confirm whether the provider asks you to publish a TXT record or a CNAME that resolves to its key. Do not regenerate or replace keys merely because common-selector probing returns no matches.
1024-bit RSA key
For new RSA DKIM deployments, 2048-bit keys are commonly recommended where supported. A 1024-bit RSA key is not automatically proof of a failed signature, but it may justify planned replacement.
Key rotation
Rotate keys according to your provider's policy, your risk assessment, or after suspected compromise. Publish the replacement key, switch signing to the new selector, and retain the old public key long enough for previously signed mail to finish delivery and for relevant caching to expire. There is no universally safe 48-72-hour expiry rule for every environment.
How It Works
Enter Your Domain
Type your domain name without http:// or www
We Probe Selectors
Common names can find known configurations. A miss does not prove DKIM is absent.
Get Instant Results
Review the published key record. A public key does not verify a specific email signature.
Frequently Asked Questions
What is a DKIM selector?
A DKIM selector identifies the DNS public-key record used to verify a message signature. For example, a message signed with selector selector1 and signing domain example.com is commonly checked at selector1._domainkey.example.com. The selector value appears in the s= tag of a DKIM-Signature header, while the signing domain appears in d=.
Can MXScan discover every DKIM selector?
No. DKIM selectors are not published in a universal index. Checking common names can find known configurations, but a "no selector found" result does not prove DKIM is absent or disabled. For a definitive lookup, use the actual selector from a signed message or your provider's DKIM configuration screen.
What does a DKIM DNS lookup validate?
A DNS lookup can identify the published key record and surface record-format or key-configuration issues supported by the checker. It cannot tell whether a specific email was signed correctly, whether its body was altered after signing, or whether a receiving server accepted the signature. Verifying a message requires the complete signed message and its DKIM-Signature header.
DKIM key size and key rotation
For new RSA DKIM deployments, 2048-bit keys are commonly recommended where supported. The appropriate algorithm and key length also depend on your provider, receiving systems and current security requirements. A 1024-bit RSA key is not automatically proof of a failed signature, but it may justify planned replacement.
Rotate keys according to your provider's policy, your risk assessment, or after suspected compromise. During a planned rotation, publish the replacement key, switch signing to the new selector, and retain the old public key long enough for previously signed mail to finish delivery and for relevant caching to expire. There is no universally safe 48-72-hour expiry rule for every environment.
Can I have multiple DKIM selectors?
Yes, you can have multiple DKIM selectors per domain. This is useful for different email services, key rotation, or redundancy. Each selector points to a different public key.
What if no key is found?
Check that the selector and signing domain are correct. Confirm whether the provider asks you to publish a TXT record or a CNAME that resolves to its key. Recheck DNS after publication and consult the provider's instructions. Do not regenerate or replace keys merely because common-selector probing returns no matches.
Understanding DKIM: The Complete Guide
DKIM (DomainKeys Identified Mail) publishes a public key that receivers can use when checking a signature. A valid DKIM signature shows that the signed message parts verify against the published key for the signing domain; it does not, by itself, prove the visible From address is aligned or that the sender is trustworthy.
How DKIM Works
DKIM uses public-key cryptography:
- Key generation - You generate a public/private key pair
- DNS publication - The public key is published in DNS as a TXT record
- Message signing - Your mail server signs outgoing emails with the private key
- Verification - Receiving servers fetch your public key from DNS and verify the signature
A valid DKIM signature shows that the signed message parts verify against the published key for the signing domain; it does not, by itself, prove the visible From address is aligned or that the sender is trustworthy.
What is a DKIM selector?
A DKIM selector identifies the DNS public-key record used to verify a message signature. For example, a message signed with selector selector1 and signing domain example.com is commonly checked at selector1._domainkey.example.com. The selector value appears in the s= tag of a DKIM-Signature header, while the signing domain appears in d=.
Names sometimes seen in published records include:
- google - Google Workspace
- selector1, selector2 - Microsoft 365
- k1, k2, k3 - Mailchimp
- default - Many email services
- s1, s2 - Amazon SES
You can have multiple selectors per domain, which is useful for different email services or key rotation.
Can MXScan discover every DKIM selector?
No. DKIM selectors are not published in a universal index. Checking common names can find known configurations, but a "no selector found" result does not prove DKIM is absent or disabled. For a definitive lookup, use the actual selector from a signed message or your provider's DKIM configuration screen.
What does a DKIM DNS lookup validate?
A DNS lookup can identify the published key record and surface record-format or key-configuration issues supported by the checker. It cannot tell whether a specific email was signed correctly, whether its body was altered after signing, or whether a receiving server accepted the signature. Verifying a message requires the complete signed message and its DKIM-Signature header.
What if no key is found?
Check that the selector and signing domain are correct. Confirm whether the provider asks you to publish a TXT record or a CNAME that resolves to its key. Recheck DNS after publication and consult the provider's instructions. Do not regenerate or replace keys merely because common-selector probing returns no matches.
DKIM key size and key rotation
For new RSA DKIM deployments, 2048-bit keys are commonly recommended where supported. The appropriate algorithm and key length also depend on your provider, receiving systems and current security requirements. A 1024-bit RSA key is not automatically proof of a failed signature, but it may justify planned replacement.
Rotate keys according to your provider's policy, your risk assessment, or after suspected compromise. During a planned rotation, publish the replacement key, switch signing to the new selector, and retain the old public key long enough for previously signed mail to finish delivery and for relevant caching to expire. There is no universally safe 48-72-hour expiry rule for every environment.
Reading DKIM record tags
The p= tag carries the public key material, and k= identifies the key type where specified. The t=y flag indicates testing; t=s indicates that the key should be used only for the exact signing domain, not subdomains. Do not describe t=s as a testing flag.
DKIM specification: RFC 6376. Related reading: DKIM after a migration and DMARC alignment.
Common DKIM issues
- No key at the name checked - This does not prove DKIM is absent or disabled.
- Invalid signature - Message was modified after signing (often by mailing lists)
- Key mismatch - Private and public keys don't match
- DNS propagation - New keys not yet visible to all DNS servers
- Body hash mismatch - Email content changed after signing
Monitor Your DKIM Keys Daily
Get alerts when DKIM keys expire, rotate, or have issues.
Start Free Monitoring