Free tool · No signup
DKIM checker: find your DKIM selector and key.
Enter your domain and we look for a DKIM public key on 23 common selectors, including Google Workspace, Microsoft 365, Zoho, Proton, Fastmail and the big sending services. Know your selector? Enter it too. Free, no signup.
Opens at the DKIM result, inside the full report for your domain: MX, SPF, DKIM, DMARC, 9 blacklists and domain age, graded 0 to 100.
The basics
What DKIM does
DKIM signs every email you send with a private key; the matching public key sits in DNS under a selector, at selector._domainkey.yourdomain.com. Receivers use it to check the email wasn't changed and really comes from your domain. Gmail asks bulk senders for DKIM alongside SPF and DMARC.
What this check looks at
- A DKIM public key on any of 23 common selectors, such as google (Google Workspace), selector1 and selector2 (Microsoft 365), zmail (Zoho) and the selectors of Mailchimp, SendGrid, Mailgun, Mailjet and Resend.
- Your own selector, if you enter it under “Using a custom DKIM selector?”.
- Revoked keys: a selector whose record has an empty key, which signs nothing.
Problems and fixes
What the checker can find, and the fix it gives you.
| Problem | Fix |
|---|---|
| No DKIM key found | Turn on DKIM signing in your mail provider and publish the TXT record it gives you. If you use a custom selector, enter it in the checker. |
| Only revoked keys | Generate a new key in your mail provider, publish it and turn signing on. |
The honest part
What this check can't tell you.
The check can only find keys on selectors it knows or that you give it. If your provider uses an unusual selector, open a sent email, find the DKIM-Signature header and read the value after s=.
More free checks
Check the rest of your setup.
- Full domain check MX, SPF, DKIM, DMARC, 9 blacklists and domain age in one report, graded 0 to 100.
- MX lookup Free MX lookup: see your domain's MX records in priority order, which provider receives your mail, and whether its mail servers are on 6 IP blacklists. No signup.
- SPF checker Free SPF checker: look up your SPF record, count its DNS lookups against the limit of 10 and get the exact fix for each problem. No signup.
- DMARC checker Free DMARC checker: find your DMARC record, read its policy and report address, and get the exact fix. Gmail and Yahoo require DMARC from bulk senders.
- Blacklist check Free blacklist check: your domain on Spamhaus DBL, SURBL, URIBL, and your mail servers on 6 IP lists including Spamhaus ZEN. Results in seconds, no signup.
Questions
Ballast is cold email software with every feature on every plan. Connect unlimited mailboxes, send sequences at a pace your domains survive, and handle replies in one inbox, priced by the emails you send.
How do I find my DKIM selector?
Open an email you sent, show the original message and find the DKIM-Signature header. The value after s= is the selector, and d= is the signing domain. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2.
Why does the checker find no DKIM key?
Either signing is off in your mail provider, the record isn't published yet, or your provider uses a selector we don't try. Enter your selector in the checker to look it up directly.
Can I have more than one DKIM key?
Yes. Each sending service signs with its own selector, so a domain that sends from Google Workspace and a marketing tool usually has two keys. Each needs its own record.
Ballast runs this check every night.
For every domain you send from, with sending that pauses before a problem costs you the inbox. Every feature on every plan, from $19 a month.