DKIM DNS Lookup Helper
Build the exact DNS query name for any DKIM selector — Google, Mailchimp, SendGrid, Klaviyo, HubSpot, custom — and get instant one-click lookup links via MXToolbox, DNSChecker, and Google\u2019s DNS Web tool. Plus a paste-and-validate mode for inspecting existing DKIM records.
DKIM Inputs
Query URL + Validation
How to use the DKIM DNS Lookup Helper
Lookup mode: Enter your domain and pick the sending service. The tool constructs the exact DNS query name (e.g., `google._domainkey.yoursite.com`) and links to three lookup tools (MXToolbox, DNSChecker, Google DNS). Validate mode: Paste an existing DKIM TXT record. The tool checks version, key type, key strength (1024 vs 2048 bits), and testing-mode flags.
Why this tool matters
DKIM is the second pillar of email authentication (after SPF and before DMARC). Finding the right DKIM selector for your sending service is the #1 stumbling block — different services use completely different selector naming conventions. This tool eliminates the guesswork and validates that the key is current, strong, and production-ready.
Common use cases
- Setting up DKIM for the first time on a new domain
- Migrating between email service providers
- Confirming DKIM is published correctly after a DNS change
- Auditing a client\u2019s DKIM configuration during deliverability work
- Quick check that a DKIM key is RSA-2048 (modern standard) vs RSA-1024 (deprecated)
Why DKIM selectors are so confusing
Every sending service uses their own selector naming convention. Google uses “google”. Mailchimp uses “k1”. SendGrid uses “s1” and “s2”. HubSpot uses “hs1-{your-portal-id}”. Klaviyo uses “dkim”. Amazon SES uses a hash-based selector. There\u2019s no standard. Knowing each one saves hours of trial-and-error.
Frequently Asked Questions
What if my DKIM key is 1024 bits?
Most major providers (Google, Yahoo) accept 1024 but discourage it. RSA-2048 is the modern standard. If your ESP allows it, rotate to 2048-bit. Test with the new selector before retiring the old one.
Can I have multiple DKIM records?
Yes — different selectors for different services. You\u2019ll have separate TXT records at `service1._domainkey.yoursite.com`, `service2._domainkey.yoursite.com`, etc. They\u2019re independent.
What does t=y mean?
Testing mode — the receiving server should not enforce DKIM policy yet. Useful during initial rollout but should be removed for production. Many ESPs accidentally leave testing mode on.
Why is the TXT record split into multiple strings?
DNS TXT records are limited to 255 characters per string. DKIM public keys often exceed this. The fix is multi-string TXT records (DNS providers handle this — paste the full key, they\u2019ll split it).
Need a full email authentication setup including SPF, DKIM, DMARC, and BIMI?
Riman Agency runs email programs with rigorous authentication.