DKIM DNS Lookup Helper
Build the DNS name for any DKIM selector, check the live record and validate key type, key strength and testing flags.
Find your DKIM record
Validate a record
How to use the DKIM lookup helper
Lookup: enter your domain and pick your sending service. The tool builds the exact DNS name to query, such as google._domainkey.yourdomain.com, checks the live record with one click and links to MXToolbox, DNSChecker and Google DNS. Validate: paste an existing DKIM TXT record, or let the live check fill it in. The tool checks the version, key type, real key length and testing flags.
Why DKIM matters
DKIM is one of the three pillars of email authentication, alongside SPF and DMARC. It adds a cryptographic signature that proves a message really came from your domain and was not altered. Finding the right selector for each sending service is the most common stumbling block, because every provider names its selectors differently.
Common use cases
- Setting up DKIM on a new domain
- Moving to a new email service provider
- Confirming DKIM is published correctly after a DNS change
- Auditing a client's DKIM setup during deliverability work
- Checking whether a key is 2048-bit or the older 1024-bit
Why DKIM selectors are confusing
There is no standard naming. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, Mailchimp uses k1, SendGrid uses s1 and s2, Klaviyo uses kl and kl2, and HubSpot uses hs1 and hs2 followed by your account ID. Amazon SES uses random-looking hashes. If you are unsure, open a message you sent, view the original headers and read the s= value in the DKIM-Signature line.
Frequently asked questions
What if my DKIM key is 1024 bits?
Most mailbox providers still accept 1024-bit keys, but 2048-bit RSA is the current recommendation. If your provider allows it, publish a 2048-bit key under a new selector, switch signing to it, and retire the old one once mail is flowing.
Can I have several DKIM records?
Yes. Each sending service gets its own selector, so records live at different names like s1._domainkey.yourdomain.com and k1._domainkey.yourdomain.com. They do not conflict.
What does t=y mean?
It marks the domain as testing DKIM, asking receivers not to treat failures differently from unsigned mail. It is handy during rollout but should be removed once everything works.
Why is my record split into several strings?
A single TXT string can hold at most 255 characters, and 2048-bit keys are longer than that. The record is stored as several strings that are joined back together. Most DNS hosts split it for you when you paste the full value.