How to use this tool
Enter the domain and your email provider's selector, or the full selector._domainkey DNS name. Displays only DKIM TXT policies and inspects the public key. This is not an email signature verification.
Enter the target, complete any relevant options and choose Check. Review the requested records, query outcomes and diagnostic findings. Copy Report saves the visible report.
Reading the results
No matching records and an unavailable query are different outcomes. TTLs are displayed in seconds; zero is a valid TTL. A completed request does not mean a domain passed its health checks. Only the submitted DNS owner and explicitly listed checks are inspected.
Frequently Asked Questions
Does the page ask for a selector separately?
No. It has one domain input and does not construct a DKIM hostname. Enter the full selector._domainkey.example.com name yourself.
Does the checker validate the DKIM public key?
No. It displays DNS values without parsing key type, key material, flags, or syntax.
Why does a root domain query not show DKIM?
DKIM records are normally owned by selector-specific _domainkey hostnames, not by the root domain.
Can the tool find an unknown DKIM selector?
No. It does not enumerate selectors. Obtain the selector from the mail provider or a signed message header.
Does a returned key prove DKIM signing works?
No. The page does not inspect messages, signatures, canonicalization, or alignment.
Why might an old DKIM key remain visible?
Resolver caching can retain the former TXT record until its TTL expires after a key rotation.