How to Check a DKIM Record for a Domain
A practical guide to checking DKIM records, finding the selector, and understanding what a valid DKIM lookup can and cannot tell you.
DKIM checks are easy to talk about and surprisingly easy to do badly.
That is usually because people know the domain, but not the selector.
What DKIM actually needs
DKIM is not usually published at the domain apex.
It is typically published at a selector name such as:
selector1._domainkey.example.com
That is why “show me the DKIM record for this domain” is slightly incomplete unless you already know the selector.
The quick way to start
Use Domain Lookup to review the domain’s broader email and TXT context first.
Then confirm which sending system or selector you are actually meant to check.
That order prevents a lot of blind guessing.
What a DKIM check is really asking
You usually want to know:
- does the selector exist?
- is the TXT record present?
- does it look structurally correct?
- is the domain actually signing mail with it?
The last question matters because a record can exist without being used consistently by the real sender.
Why DKIM checks go wrong
Common reasons:
- the selector name is wrong
- the record is published in the wrong DNS provider
- the wrong domain is being checked
- the sending platform changed selectors and the old assumption survived
That is why DKIM checks are part DNS and part sender-configuration problem.
DKIM is not the whole email story
A DKIM record can look fine while the domain still has:
- weak SPF
- weak DMARC
- inconsistent sender behaviour
So DKIM should usually be read as part of a wider mail-auth review.
Useful next reads:
The short version
To check DKIM properly, you need the selector and the right DNS context.
Without that, “DKIM lookup” usually turns into guesswork fast.
Continue reading
Stay in the same investigation track with these closely related guides.
Tools mentioned in this article
Run the same diagnostics to follow along with the guide.