DKIM Record Analyzer

Query the DKIM TXT record. Use your signing domain, the _domainkey zone name, or paste the full query name in one field.

Understanding DKIM and the results

DKIM (DomainKeys Identified Mail) works like an invisible digital signature added to your emails. Its job is to show servers such as Gmail or Outlook that the message really comes from your domain and was not altered in transit. Without this signature, your mail is very likely to land in the Spam folder.

What do the technical fields mean?

When you look up your record, you will see a set of tags. Here is what each one means so you can validate them:

Tag Name Meaning
v= Version Must always be DKIM1. If it is missing or different, the record is considered invalid.
k= Algorithm Indicates the key technology. The most common value is rsa; modern services may use ed25519.
p= Public key The most important field. A long random-looking string (Base64). It acts as the “key” the recipient uses to verify your mail.
t= Flags (Optional) If you see a y, the record is in “test” mode. Servers may ignore the signature while this mode is active.
n= Notes (Optional) Free text sometimes used for administrative or contact notes.

Frequently asked questions

Why doesn’t my record show up when I only enter my domain?
Unlike many other records, DKIM lives on a specific subdomain called a “selector”. To find it, you need to know that selector name.
I copied the “p” key but I get an error—what happened?
Make sure you did not copy leading or trailing spaces. If your key is very long (2048 bits), check that your DNS provider did not split it into several parts; the key must be read as one continuous string.
How long until it takes effect?
Any DNS change can take between 1 and 24 hours to propagate worldwide. If you have just configured it, wait a while before running the test again.