DKIM checker
Look up which of the common DKIM selectors publish a signing key for a domain — live DNS TXT queries, free, and clear about the selectors it does not know.
try:
What a DKIM selector is
DKIM signs outgoing mail with a private key and publishes the public half in DNS at <selector>._domainkey.<domain>. The selector is a label the signer picks, which lets one domain run several keys at once: one for the mailbox provider, one for the newsletter platform, one for the ticketing system. Receivers read the selector off the message's DKIM-Signature header, fetch that key, and verify the signature.
Why this checker can miss a key
There is no way to list every selector a domain publishes: DNS does not enumerate names under _domainkey. So this page asks for the selectors the large providers and sending platforms use by default, and reports the ones that answer with a key. A key found here is a real key. A key not found here may sit under a name the list does not know, which is why the result says "none of the common selectors" and never "no DKIM".
Frequently asked questions
Which selectors does the checker look up?
The names the large providers and sending platforms use by default: google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, s1 and s2 for SendGrid, fm1 to fm3 for Fastmail, protonmail, zoho, mandrill, pm for Postmark, mte1 and mte2 for Mailgun, and about thirty in all. Each is one TXT query at selector._domainkey.domain.
Does "none found" mean the domain has no DKIM?
No. A selector is any label the signer chooses, so a domain that signs under its own name (s2024, mail-eu, k2) publishes a perfectly good key this list never asks for. The only definitive source is the DKIM-Signature header on a real message, or the domain’s DMARC aggregate reports. Read "none of the common selectors" exactly as it says.
What does a DKIM key actually do?
The sending server signs each message with a private key; the matching public key sits in DNS under the selector. A receiver fetches it, checks the signature, and knows the message was not altered and was signed by something that controls the domain’s DNS. DMARC then requires that signing domain to align with the visible From address.
Why does an email verification API care about DKIM?
It does not use it to decide whether an address exists. On the domain endpoint it is one of the hygiene signals: a business domain that signs its mail and enforces DMARC is a maintained domain, which is useful context when a signup arrives from it. The per-address lookup deliberately does not pay for these lookups.
Data synced on 2026-09-14: the newest sync of the open lists and curated maps behind every answer on this page. The domain's own records are read live at each check.
More free tools
All free toolsNeed this at scale?
The Spaw API runs the same checks plus mailbox-level SMTP verification, batch and bulk endpoints, and list monitoring — 10 free lookups a month, no card required.