← Email Security Tools
DKIM Record Lookup
Check your domain's DKIM record instantly. Identify missing or broken configurations before they cause email deliverability problems.
Free DKIM Record Checker
Enter your domain and selector to check what DKIM record is currently published in DNS.
What is a DKIM record?
DKIM, or DomainKeys Identified Mail, is a digital signature system for business email. When your mail server sends a message, it attaches a cryptographic signature tied to your domain. The receiving mail server looks up your DKIM record in DNS and uses the public key stored there to verify the signature is valid and the message was not altered in transit. If the record is missing or the signature does not match, the message fails and may be sent to spam or blocked. DKIM works alongside SPF and DMARC to form the three-layer foundation of email authentication.
To run a lookup you need two things: your domain name and your DKIM selector. The selector is a label your mail platform uses to identify which key to use. If you use Microsoft 365, try selector1 and selector2. Google Workspace uses google. Other platforms will specify their selector in your account's DNS setup instructions.
Wolferdawg IT Consulting can review your email authentication records, fix broken configurations, and keep your domain aligned with your mail platform.
DKIM record lookup — common questions
What does a passing DKIM result mean?
A passing DKIM result means the tool found a valid public key published in your DNS for the selector you entered. It confirms that your mail server can sign outgoing messages and that receiving servers will be able to verify those signatures. A pass does not guarantee your emails reach the inbox, but it removes one of the most common reasons they do not.
What does a failing DKIM lookup mean for my business email?
A failing DKIM lookup usually means the record is missing from your DNS, the selector you entered does not match what your mail platform is using, or the record was deleted or corrupted after a DNS change. When DKIM fails, receiving mail servers cannot verify your message signatures. Combined with a DMARC policy set to quarantine or reject, failing DKIM can cause legitimate business email to land in spam or be blocked outright.
What DKIM selector should I use for Microsoft 365?
Microsoft 365 uses two DKIM selectors by default: selector1 and selector2. Enter your domain and try each selector in the lookup tool. If neither returns a valid record, DKIM signing has not been enabled for your domain in the Microsoft 365 admin center, or the required CNAME records have not been published in your DNS.
My emails are going to spam. Could a DKIM problem be causing it?
Yes. Missing or misconfigured DKIM is one of the most common causes of business email landing in spam folders. If your DKIM record is absent or the signature does not match, receiving servers treat your messages as unverified. Run a DKIM lookup using this tool to check whether your record is published correctly. If the problem persists after fixing DKIM, also check your SPF and DMARC records.
Do I need DKIM if I already have SPF set up?
Yes. SPF and DKIM serve different purposes and you need both. SPF verifies that the sending server is authorized to send on behalf of your domain. DKIM verifies that the message itself was not altered in transit. DMARC, the policy layer on top, requires alignment between SPF and DKIM to enforce anti-spoofing rules. Without DKIM, your DMARC policy is weaker and your domain is more vulnerable to spoofing.
More free email security tools
Check and generate all three email authentication records.