Query the DKIM (DomainKeys Identified Mail) signing record for a domain
• Domain: enter a bare domain without https:// (e.g. example.com)
• Selector: the DKIM selector — common values are default, google, mail, etc.
• DKIM records contain the public key used to verify email signatures
A DKIM (DomainKeys Identified Mail) record lookup queries the DNS TXT record at a selector-based subdomain (e.g. default._domainkey.example.com) and returns the public key, key type, key size in bits, and any security warnings such as a revoked key, testing-mode flag, or key shorter than the recommended 2048 bits.
Common uses include verifying that the DKIM public key is published correctly after setting up a new email provider, checking key size during a security audit, confirming the correct selector when troubleshooting DKIM verification failures, and ensuring the key has not been revoked or left in testing mode in production.
A selector is a label that allows a domain to publish multiple DKIM keys simultaneously — useful when different services send email on behalf of the domain. The selector is included in the email signature header and tells receivers which key to use for verification.
An empty p= tag means the key has been intentionally revoked. Emails signed with the corresponding private key will fail DKIM verification. Revocation is used to decommission old keys without deleting the DNS record.
2048-bit RSA is the current recommended minimum. 1024-bit keys are considered weak. Ed25519 keys are much shorter but equally secure and are supported by modern mail systems.
Check that the selector matches exactly (common values are 'default', 'google', 'mail', 's1', 's2'). The record is published at <selector>._domainkey.<domain> as a TXT record. Allow up to 48 hours for DNS propagation after adding the record.