# DKIM Record Checker Look up DKIM keys at ._domainkey. (RFC 6376). With a selector it reads that one record; without one it tries up to 24 documented common selectors (google, selector1, selector2, k1, s1, default, ...), ordered by the provider seen in the MX records. Parses every tag (v, k, p, h, s, t, n), follows CNAME delegation to providers, decodes the key (RSA length in bits, Ed25519) and flags RSA under 1024 bits (error), 1024 bits (warning, RFC 8301), sha1-only, t=y testing mode, revoked (empty p=) and syntax errors. Selectors cannot be enumerated, so none found is not proof of no DKIM; the result says what was tried. **Not for:** Verifying a signature on a real message (use email_header_analyze) or generating a key (use dkim_record_format). - Tool id: `dkim-checker` - Category: email - Execution: fanout - MCP tool `dkim_check` at https://lookupowl.com/mcp - REST `GET https://lookupowl.com/api/v1/tools/dkim-checker` (or POST a JSON body) - OpenAPI: https://lookupowl.com/api/openapi.json ## Input | Field | Type | Required | Default | Description | |---|---|---|---|---| | `domain` | string | yes | | Domain that sends the mail, e.g. example.com. A URL, an e-mail address or a full key name such as google._domainkey.example.com is reduced to the domain (and the selector, when it is in the name). max length 253 | | `selector` | string | no | | DKIM selector, the "s=" value of a DKIM-Signature header, e.g. google or selector1. Leave it out to try a short list of common selectors. max length 100 | | `discover` | boolean | no | `true` | When no selector is given, try the documented list of common selectors (at most 24). DKIM selectors cannot be listed, so finding none is not proof that the domain has no DKIM. | ## Output Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields: | Field | Type | Description | |---|---|---| | `domain` | string | | | `mode` | "selector" \| "discovery" | | | `status` | "ok" \| "warning" \| "error" \| "missing" \| "none-found" \| "dns-error" | ok / warning / error: the worst finding among the keys found. missing: the given selector has no record. none-found: discovery tried common selectors and found none (not proof of no DKIM). dns-error: the resolver could not answer. | | `found` | object[] | | | `discovery` | object | | | `issues` | object[] | | | `notes` | string[] | | | `dnsQueries` | integer | min -9007199254740991, max 9007199254740991 | | `ttl` | integer | min -9007199254740991, max 9007199254740991 | | `incomplete` | boolean | The time limit was reached before every selector was tried. | ## Examples ### Find the selectors of github.com ```json {"domain":"github.com","discover":true} ``` ```bash curl 'https://lookupowl.com/api/v1/tools/dkim-checker?discover=true&domain=github.com' ``` Web page: https://lookupowl.com/dkim-checker?q=github.com ### A Microsoft 365 selector (CNAME delegation) ```json {"domain":"microsoft.com","selector":"selector2","discover":true} ``` ```bash curl 'https://lookupowl.com/api/v1/tools/dkim-checker?discover=true&domain=microsoft.com&selector=selector2' ``` Web page: https://lookupowl.com/dkim-checker?q=microsoft.com&selector=selector2 ### A revoked key (empty p=) ```json {"domain":"google.com","selector":"20230601","discover":true} ``` ```bash curl 'https://lookupowl.com/api/v1/tools/dkim-checker?discover=true&domain=google.com&selector=20230601' ``` Web page: https://lookupowl.com/dkim-checker?q=google.com&selector=20230601 ## Web pages - https://lookupowl.com/dkim-checker ## Limits and caching - Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers. - Cache: the lifetime follows the data (for DNS, the record TTL, within a few minutes). Add `fresh=true` (MCP argument or query parameter) to look again; it costs 3 units per unit and is limited to 10 per hour. - Timeout: 12 s. ## Related tools - [DMARC Record Checker](https://lookupowl.com/tools/dmarc-checker.md): Look up and validate a domain's DMARC policy, report addresses and alignment settings. - [SPF Record Checker](https://lookupowl.com/tools/spf-checker.md): Check a domain's SPF record, count its DNS lookups against the limit of 10 and find errors. - [DNS Lookup](https://lookupowl.com/tools/dns-lookup.md): Look up A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, DS and DNSKEY records from a public resolver or the authoritative nameserver. - [IP and Domain Blacklist Checker](https://lookupowl.com/tools/blacklist-checker.md): Check an IP address, a mail server or a domain against live spam blocklists, with how to get delisted. ## Guide: DKIM checker Find the DKIM keys a domain publishes, even when you do not know the selector, and see whether each one is strong enough. ### What the DKIM checker does DKIM lets a mail server sign each message with a private key. The matching public key sits in your DNS, and the receiving server fetches it to prove the message really came from your domain and was not changed on the way. This checker reads that public key and tells you if it is usable. Enter a domain and, if you have it, a selector. The selector is the name of the key, and it is the `s=` value in the `DKIM-Signature` header of any message you sent. The key lives at `._domainkey.`. For the selector `google` on `example.com` that is `google._domainkey.example.com`. The checker reads every tag in the record, follows a CNAME if your provider manages the key for you, decodes the key itself and reports its type and length. It flags short RSA keys, a revoked key, testing mode, a SHA-1 only key and records that are cut short or mistyped. ### What happens when you do not know the selector A domain can publish any number of selectors with any names, and DNS gives no way to list them. So no tool can promise to find every key. What we can do is try the names that mail providers document and that people use by default: `google`, `selector1`, `selector2`, `k1`, `s1`, `default` and a few more. - We try at most 24 names, and the result lists every one we tried. - The mail servers of the domain tell us who hosts its mail, so that provider's selectors go first. - If the name `_domainkey.` does not exist in DNS at all, no selector can exist below it, and we say so after a few quick checks. - If nothing turns up, the result says "none found" and explains that this is not proof. It never says the domain has no DKIM unless DNS shows it. > **The surest way to get the selector** Send yourself a message from the domain, open its original source and look for the line that starts with `DKIM-Signature`. The `d=` value is the domain and the `s=` value is the selector. Put that selector in the box for an exact answer. ### Reading a DKIM result | Tag | Meaning | Example | |---|---|---| | `v` | Version. Optional, but if it is there it must come first and read `DKIM1`. | `v=DKIM1` | | `k` | Key type: `rsa` (the default) or `ed25519`. | `k=rsa` | | `p` | The public key in base64. An empty `p=` means the key was revoked on purpose. | `p=MIIBIjAN...` | | `h` | Hash algorithms the key accepts. `sha1` alone is not allowed any more. | `h=sha256` | | `s` | Services the key is for. `*` or `email` are the normal values. | `s=email` | | `t` | Flags. `y` means testing, `s` means the key is only for this exact domain. | `t=y` | | `n` | A note for humans. Receivers ignore it. | `n=rotated 2026-01` | Key length matters. RFC 8301 says RSA keys under 1024 bits are not acceptable, so mail signed with one fails. A 1024 bit key still works but is on its way out, and 2048 bits is the size to publish. Longer than 2048 bits rarely helps and can make the DNS record too big for some resolvers. Many services publish the key for you. A CNAME from `selector1._domainkey.example.com` to a name at `onmicrosoft.com` means Microsoft 365 owns the key and rotates it. The result shows the CNAME, names the provider when it knows it, and tells you if the target has no key behind it, which breaks DKIM. > **In Claude, ChatGPT or Cursor** Connect the LookupOwl MCP server and ask: "Does example.com have a strong DKIM key?" The assistant calls `dkim_check` and reads the same structured answer you see here. ### Fixing what the checker finds 1. **No key at your selector**: The record is not published at exactly that name, or the selector in the header is spelled differently. Compare the `s=` value with the name in your DNS panel, and check that the zone you edited is the one that answers for the domain. 2. **Key too short**: Generate a 2048 bit key in your mail platform, publish it under a new selector, switch signing to the new selector, and remove the old record after a few weeks. 3. **Testing mode is on**: Remove `t=y` once signatures verify. Some receivers distrust a domain that stays in testing. 4. **Record broken**: A long key is split into several quoted strings in DNS. If one piece is missing or a stray space came in, the key cannot be read. Republish the whole record. DKIM is one of three checks mailbox providers combine. Check the others with the [SPF record checker](https://lookupowl.com/spf-record-checker) and the [DMARC checker](https://lookupowl.com/dmarc-checker). If your mail still lands in spam after all three pass, check whether your sending address appears on a blocklist. ### Frequently asked questions **What is a DKIM selector?** The selector is the name of one DKIM key. A domain can have many keys, for example one per mail service, and each has its own selector. The selector is part of the DNS name where the key is published and appears as `s=` in the DKIM-Signature header of every signed message. **Why does the checker say none found when my domain uses DKIM?** DKIM selectors cannot be listed, so the checker only tries a short set of common names. If your mail platform uses another name, enter it yourself. Find it in the `s=` part of the DKIM-Signature header of a message you sent. **How long should a DKIM key be?** Use 2048 bit RSA. A 1024 bit key still verifies but is considered weak, and keys under 1024 bits are rejected by RFC 8301. Ed25519 keys are small and strong, though not every receiver supports them yet, so most senders publish RSA. **What does an empty p= mean?** An empty `p=` tag revokes the key. Receivers treat any signature made with it as failed. That is the right way to retire a selector, and the wrong thing to see on a selector your mail platform still uses. **Do I need DKIM if I already have SPF?** Yes. SPF checks the sending server and breaks when mail is forwarded. DKIM travels with the message and survives forwarding. Gmail, Yahoo and Microsoft expect bulk senders to have both, and DMARC passes when either one lines up with your From domain. **What does t=y mean in a DKIM record?** It marks the domain as testing DKIM. Receivers are asked not to treat failures more harshly than unsigned mail, but some give signatures less weight. Remove it when you are happy that signing works. **Why is my DKIM record a CNAME?** Services such as Microsoft 365, Amazon SES and many newsletter platforms keep the key on their own DNS and ask you to point your selector at it. That lets them rotate keys without asking you. The checker follows the CNAME and reads the key at the end.