DKIM record checker
Looks up selector._domainkey.yourdomain.com, follows the CNAME if your provider manages the key, and checks the key is present, long enough, and not in test mode.
What DKIM does
DKIM signs each message with a private key. The matching public key lives in your DNS, so a receiver can verify the message really came from you and was not altered in transit. Unlike SPF it survives forwarding, which is why both are worth having.
Finding your selector
A domain can publish many DKIM keys, each under a different selector. Open a message you sent, view the original, and look at the DKIM-Signature header: the selector is the s= value. Common defaults are default, google, k1, s1 and s2.
An empty key means revoked
A record with p= and nothing after it is not broken — it is a deliberate revocation telling receivers to reject anything signed with that key. If you see it unexpectedly, a provider has rotated or withdrawn the key.
Authentication set up for you
Add a domain in Pigeonify and we generate the SPF, DKIM and DMARC records, then verify them for you. Free up to 5,000 emails a month.
Start free