DKIM Record Lookup

DKIM (DomainKeys Identified Mail) is an email authentication protocol that uses public-key cryptography to verify that an email message was sent by an authorized mail server and has not been modified in transit.

When you send an email, your mail server creates a digital signature using a private key and adds it to the message headers as a DKIM-Signature header. The receiving server then looks up the corresponding public key in your domain's DNS records and uses it to verify the signature.

The DKIM public key is stored as a TXT record at selector._domainkey.yourdomain.com. The selector allows you to have multiple DKIM keys for the same domain — useful when you send email through different services (e.g., your primary email provider, a marketing platform, and a transactional email service).

DKIM is one of the three core email authentication protocols (alongside SPF and DMARC) required by Google and Yahoo for bulk senders since February 2024. Without a valid DKIM record, your emails are more likely to be flagged as spam or rejected entirely.

Your DKIM selector is included in every signed email your domain sends. To find it:

1. Open an email sent from your domain (send one to yourself if needed).
2. View the full email headers (in Gmail: click the three dots → "Show original").
3. Search for the DKIM-Signature header.
4. Find the s= tag — that value is your selector.

In this example, the selector is google. The full DNS lookup would be google._domainkey.example.com.

A DKIM TXT record contains several tag-value pairs. Here are the key fields to understand: