A sending domain should sign mail with DKIM and you need to confirm the selector exists in DNS.
DKIM Check
Check the live DKIM selector record for a domain.
Use DKIM Check to inspect the TXT record published at a DKIM selector hostname, confirm whether the selector exists in DNS, and compare the returned value with the signing configuration you expect.
Verify the DKIM selector in DNS before troubleshooting message signing or alignment.
Lookup result
selector._domainkey.example.com
NOERROR
Type Value TTL
No DKIM TXT records were returned for this selector hostname by the resolver.
What this DKIM Check tool does
DKIM Check queries the TXT record published at selector._domainkey.domain
and shows the live value currently visible from a public recursive resolver.
Use it to confirm whether a DKIM selector exists, inspect the returned TXT value, and compare it with the public key record your email provider expects.
It does not confirm that mail is actually being signed. A visible DKIM selector only confirms the DNS layer, not sender-side signing behavior or DMARC alignment.
When to use this tool
A new mail provider or signer was added and you want to verify the published DKIM public key.
Messages fail DKIM validation because the selector or TXT record may be wrong or missing.
You need to compare the live selector record with the key value your provider told you to publish.
A DNS change was made for a DKIM selector and you need to know whether resolvers can see it yet.
You want a quick DNS-layer check before moving to message-header or provider-level email debugging.
How to use DKIM Check
- Enter the DKIM selector and the domain you want to verify.
- Run the lookup and review the TXT response for the selector hostname.
- Compare the returned value with the DKIM record your email provider expects.
- Check whether the selector exists, looks complete, and matches the intended domain.
- If the result is missing or wrong, continue to propagation, SPF, DMARC, or message-level checks next.
How to interpret DKIM check results
DKIM selector found
Likely meaning: A TXT record was returned for selector._domainkey.domain.
Common causes: This usually means the selector is published and visible from the resolver used for the lookup.
Next action: Confirm the record contains the expected DKIM value and then move to DMARC, SPF, or message-level checks if signing still fails.
No DKIM selector found
Likely meaning: No TXT record was returned for the selector hostname.
Common causes: The selector may be wrong, the TXT record may not be published, or the change may not be visible yet.
Next action: Recheck the selector name, then verify DNS propagation and broader DNS visibility.
Multiple TXT records returned
Likely meaning: More than one TXT value exists at the DKIM selector hostname.
Common causes: Some providers split long keys into quoted strings, but multiple unrelated TXT values can also indicate misconfiguration.
Next action: Compare the returned value with the provider’s expected DKIM key and remove stale or conflicting records if needed.
DKIM value looks wrong or incomplete
Likely meaning: A selector record exists, but it does not match the expected public key or policy fields.
Common causes: Old selectors, truncated values, publishing errors, or the wrong selector hostname are common causes.
Next action: Compare the live TXT response against the provider’s generated DKIM record and republish if needed.
NXDOMAIN
Likely meaning: The selector hostname does not exist in DNS.
Common causes: Wrong selector name, wrong domain, or querying the wrong host entirely.
Next action: Confirm the selector and domain pair, then run DNS Lookup on the same hostname if needed.
SERVFAIL or timeout
Likely meaning: The recursive resolver could not complete the DKIM TXT lookup cleanly.
Common causes: DNSSEC failures, broken delegation, or authoritative nameserver issues can interrupt DKIM checks.
Next action: Verify nameservers and DNSSEC before assuming the DKIM provider setup is the root cause.
Common DKIM issues this tool helps uncover
Wrong DKIM selector name entered in the mail platform
TXT record published on the wrong hostname or wrong domain
Selector exists but the public key value is outdated
Recent DKIM DNS changes not yet visible across resolvers
Multiple TXT values at the selector hostname causing confusion
Nameserver or DNSSEC problems that look like DKIM failures
DNS is correct but message signing or alignment still needs checking next
Next steps after DKIM Check
Check SPF and DMARC
DKIM is only one part of email authentication. Continue with SPF and DMARC to complete the DNS-side picture.
Check DNS propagation
Use this when a DKIM selector was added or changed recently and some resolvers may still return older data.
Run DNS Lookup
Inspect the raw TXT answer for the selector hostname if you want a broader DNS-level view.
Run MX Lookup
If broader email delivery issues are involved, confirm the domain’s mail-routing records as the next check.
Related tools
SPF Check
Review SPF records and authorized sending sources for a domain.
DMARC Check
Inspect DMARC policy, alignment, and reporting configuration.
MX Lookup
Inspect mail exchange records and delivery destinations for a domain.
DNS Lookup
Query A, AAAA, CNAME, TXT, and other DNS records for a domain.
DNS Propagation Check
Verify whether recent DNS changes are visible across resolvers.
SMTP Test
Test SMTP connectivity and common mail transport responses.
DKIM Check FAQ
What does DKIM Check verify?
It checks the live TXT record at selector._domainkey.domain so you can confirm whether the DKIM selector is published and visible in DNS.
What input should I enter?
Enter the DKIM selector and the domain. You can also paste a full host like selector._domainkey.example.com and the tool will split it for you.
Why does no DKIM record appear?
The selector may be wrong, the TXT record may not be published yet, or the record may exist on a different domain or hostname than expected.
Does this confirm DKIM signing is working?
No. This confirms the DNS selector record only. Actual message signing can still fail because of sender configuration, rotation issues, or alignment problems.
Why do I see multiple TXT values?
Long DKIM keys are often split into quoted chunks inside DNS responses, but multiple unrelated TXT values can also point to stale or conflicting configuration.
What should I check after DKIM Check?
Usually SPF, DMARC, propagation, and the actual message headers or sending platform configuration depending on what looks wrong.