DKIM Checker – Free DKIM, SPF & DMARC Record Lookup

How it works

A full email authentication check in one go

No login, no email address. Just the domain you send mail from.

01

Enter your domain

Type the part after the @ in your email address. Add a DKIM selector if you know it, or let us scan the common ones.

02

We read live DNS

We fetch your SPF, DKIM and DMARC records, follow every SPF include to count lookups, and measure the length of each DKIM key.

03

Fix what's flagged

Each record gets a pass, warning or fail, a short reason, and a ready-to-paste example for anything that's missing.

The basics

What are DKIM, SPF and DMARC?

Three DNS records that prove an email really came from your domain. Each one covers a gap the others leave open.

SPF

Who is allowed to send

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers and services allowed to send mail for you. When a message arrives, the receiving server checks the sending IP against that list. It only covers the hidden "envelope" sender, and it breaks when mail is forwarded, which is why it can't do the job alone.

DKIM

Proof the message wasn't changed

DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. Your provider signs with a private key, and you publish the matching public key in DNS under a selector. Receivers check the signature against that key. A valid signature survives forwarding and proves the content wasn't altered on the way.

DMARC

What to do when checks fail

DMARC ties SPF and DKIM to the address people actually see in the From line, then tells receivers what to do with mail that fails: nothing (none), spam folder (quarantine) or block (reject). It also sends you daily reports, so you can see every service sending as your domain, including the ones that shouldn't be.

Together they stop spoofing and phishing in your name, and they decide a big part of whether your newsletters, invoices and order emails reach the inbox. A missing or broken record is one of the most common reasons legitimate mail lands in spam.

DKIM selectors

How to find your DKIM selector

A selector is the label that points receivers to the right DKIM key. The key lives at selector._domainkey.yourdomain.com, so without the selector nobody can look it up. Domains often have several, one per sending service, and there's no DNS query that lists them all.

The quickest way to find yours is to read it from a message you've already sent:

Send yourself an email from the service you want to check, for example your Google Workspace mailbox or your newsletter tool.
Open the full headers. In Gmail, open the message, click the three-dot menu and choose Show original. In Outlook on the web, use the three-dot menu, then View and View message source. In Apple Mail, choose View, Message, All Headers.
Find the DKIM-Signature line and look for s=. The value after it is the selector. The d= value next to it is the signing domain.
Enter both above: the d= domain in the domain field and the s= value as the selector.

Common DKIM selectors by provider
Provider	Usual selector
Google Workspace	The selector shown in Google Admin under Apps → Google Workspace → Gmail → Authenticate email. Usually `google` unless an admin set a custom prefix. Gmail.com itself uses date-based selectors like `20230601`.
Microsoft 365	`selector1` and `selector2`
SendGrid	`s1` and `s2`
Mailchimp	`k1`, `k2` or `k3`
Mandrill	`mandrill`
Amazon SES	Three random 32 character strings, read them from a header
Zoho Mail and most hosts	Whatever name was set when the key was created

If a provider tells you to add a CNAME instead of a TXT record, that's normal. The CNAME points to a key the provider hosts and rotates for you, and this checker follows it automatically.

FAQ

Frequently asked questions

Why does the DKIM check say no record when I know DKIM is set up?

Almost always it is the selector. DKIM keys live at selector._domainkey.yourdomain, and there is no way to list every selector a domain uses. We scan the most common names, including Google's date-based selectors like 20230601, but many providers use their own. Find the s= value in the DKIM-Signature header of an email you sent, enter it as the selector, and check again. If it still fails, the record may not have propagated yet or was pasted with a typo.

Do I need SPF, DKIM and DMARC, or is one enough?

You need all three. SPF and DKIM prove a message is allowed and unchanged, and DMARC tells receivers what to do when both fail. Gmail and Yahoo have required all three for bulk senders since 2024, and Microsoft added similar rules for Outlook.com in 2025. Even small senders see better inbox placement with the full set.

What is the SPF 10 lookup limit?

Receivers stop evaluating SPF after 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside your includes. Go over 10 and SPF returns a permanent error, which counts as a fail for DMARC. This checker follows every include and shows how many lookups each one costs.

When is it safe to move DMARC from p=none to p=reject?

When your aggregate reports show every service that legitimately sends for you passing SPF or DKIM with alignment. That usually takes 2 to 4 weeks of reading reports. Go to p=quarantine first, watch for anything that breaks, then move to p=reject. Skipping straight to reject can block your own invoices or newsletters.

How long do DNS changes take to show up here?

Usually a few minutes, sometimes up to the record's TTL, which is often one hour and can be up to 48 hours. This tool queries live DNS with no caching of its own, so if your DNS host shows the new record but the check doesn't, wait for the old TTL to expire and run it again.

Emails still landing in spam?

We set up SPF, DKIM and DMARC across every service you send from, read the reports with you, and move you to p=reject without blocking real mail.

Book a free call

DKIM, SPF & DMARC Checker