Checker · DKIM DKIM checker: is the signing key published and strong enough?
DKIM signs each message; receivers fetch the public key from selector._domainkey.domain to verify it. Unlike SPF and DMARC, you need the selector to find the key. This checker looks it up, follows provider aliases and checks the key length.
- 10 record types
- Compare 3 resolvers
- Sent only when you click
Check a DKIM key
The selector is the s= value in the DKIM-Signature header of a message you sent. Provider buttons fill in selectors from their official setup guides.
cloudflare-dns.com), Google (dns.google) or Alibaba Cloud (dns.alidns.com) — for the name and record type, nothing else. Checks that follow a chain (SPF includes, MX hosts) send those names to the same service. TapCub’s servers are not involved and store nothing.Subdomains, underscore names such as _dmarc.example.com and international domains all work.
The part before ._domainkey.
In mainland China, Alibaba Cloud is usually reachable when the other two are not.
v=DKIM1; k=rsa; p=… Checked in your browser.
Key length (bits)
2,048
Summary
- OKRSA key of 2048 bits: meets the RFC 8301 recommendation.
- NoteSample result: these records were looked up on 2026-11-11 while building this page. Click Look up for live data.
Tags
| Tag | Value | Meaning |
|---|---|---|
v | DKIM1 | Version |
k | rsa | Key type (default rsa) |
p | MIIBIjANBgkqhkiG9w0BAQEF…WcKDSiQlhwIDAQAB | Public key (base64) |
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSiQlhwIDAQABShare these inputs: the values go after the # in the link, so they never reach a server.
https://tapcub.com/tools/dns-lookup/dkim
Version v1.0Updated Update history
Reading a DKIM result
The key either verifies signatures or it does not.
Key found
A TXT record with p= at the selector name. Microsoft 365, SendGrid and Amazon SES publish keys on their side and ask you for CNAME records; the tool follows them.
Key length
RFC 8301: receivers must not accept RSA keys under 1024 bits, and signers should use at least 2048. Ed25519 keys are always 256 bits and much shorter to publish.
Revoked
An empty p= means the key was withdrawn on purpose. Any mail still signed with it fails DKIM.
Not found
Usually a wrong selector, or a provider whose key is generated in its console and not yet published in your DNS.
A published key does not prove mail is being signed. Send yourself a message and check the DKIM result in its headers with the email header analyzer.
Three steps
No sign-up. One click sends the queries.
-
1
Enter a name
A domain, subdomain, URL or email address. Paste an IP address for a reverse lookup.
-
2
Pick type and resolver
Common types is the usual start. Choose “Compare all three” after a DNS change to see whether it has spread.
-
3
Look up and copy
Read the summary, then copy the zone-file lines or download them. Open the MX, SPF, DMARC or DKIM checker for mail records.
DKIM key record (RFC 6376 §3.6.1)
Only p= is required. Everything else has a default.
- Name:
<selector>._domainkey.<domain>, TXT; long keys are split into several strings and joined v=DKIM1is optional but must come first if presentk=rsa (default) or ed25519 (RFC 8463);h=lists hash algorithms, and rsa-sha1 must not be used (RFC 8301)t=ymarks a testing key;s=must include email or *
| Provider | Selector | Published as |
|---|---|---|
| Google Workspace | google (default, can be changed) | TXT you add |
| Microsoft 365 | selector1, selector2 | CNAME to Microsoft |
| SendGrid | s1, s2 | CNAME to SendGrid |
| Amazon SES (Easy DKIM) | Random tokens | 3 CNAMEs to amazonses.com |
github.com, selector google
Looked up on 2026-11-11 at google._domainkey.github.com.
| Tag | Value | Reading |
|---|---|---|
| v | DKIM1 | Version, first as required |
| k | rsa | RSA key |
| p | MIIBIjANBgkq… (392 characters) | A 2048-bit RSA public key in SubjectPublicKeyInfo form |
Gmail’s own selector 20230601 on gmail.com showed an empty p= that day: a revoked key, kept so old signatures fail cleanly.
DKIM mistakes
Usually the record is fine and something else is in the way.
Key pasted with quotes or spaces broken
Some DNS panels need the key split into 255-character strings, others join it themselves. A stray quote inside p= makes the key unreadable.
Staying on 1024-bit keys
Still accepted, but below RFC 8301’s recommendation. Most providers let you generate a 2048-bit key; rotate with a new selector.
Guessing the selector
There is no list of a domain’s selectors in DNS. Read s= from a real message’s DKIM-Signature header instead of trying names.
Where domains show up in your analytics
DNS answers practical questions behind the reports: who sent this traffic, which network a crawler came from, and how the tracking script is served.
Referring domains
Sources lists the sites that send visitors. Look up an unfamiliar one to see whether it resolves and who hosts it before you trust its traffic.
Learn moreBots counted separately
TapCub separates crawlers from people with five layers, one of them hosting networks. A PTR lookup shows the hostname a crawler’s IP publishes.
Learn moreNo CNAME tricks
TapCub does not use CNAME aliasing to make its requests look first-party. The cookie policy lists what else it deliberately does not do.
Learn moreDNS lookup questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
How do I find my DKIM selector?
Open a message you sent, view the original headers, and find DKIM-Signature: the s= value is the selector and d= is the domain. Your email provider’s DKIM setup page also shows it.
Is a 1024-bit DKIM key still OK?
It still verifies: RFC 8301 only forbids keys under 1024 bits. But it recommends 2048 bits for signers, and Amazon SES’s Easy DKIM generates 2048-bit keys by default.
Why is my DKIM record a CNAME?
Some providers (Microsoft 365, SendGrid, Amazon SES) host the key themselves so they can rotate it. You publish a CNAME, and the key lives in their DNS. The checker follows the CNAME and shows both names.
What does an empty p= mean?
The key has been revoked. RFC 6376 defines an empty p= as “this key is no longer valid”, so signatures made with it fail.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
From the domain to the visitors it brings
TapCub shows where visitors come from, separates bots from people, and adds live chat on the same snippet. No cookies in the default mode.