Cryptographic Proof
DKIM signs headers and body using a private key on the sending mail server, which mailbox providers verify against the public key published in your DNS.
DKIM Record Checker & Inspector
Verify DKIM cryptographic signatures, discover active selectors automatically across major ESPs, resolve CNAME delegations, and audit key security.
Scanning DNS & Discovering Selectors...
Querying TXT & CNAME records across top ESP selectors and mail server signatures...
Check Failed
Unable to verify DKIM record.
Audit Summary
-
-
Selectors Found
0
Key Bit Depth
-
SPF Alignment
-
DMARC Policy
-
Detected Email Ecosystem:
DKIM Selector Record Details
-
Version (v)
DKIM1
Algorithm (k)
rsa
Delegation Type
TXT Direct
Flags (t) / Services (s)
-
CNAME Delegation Target:
-
-
-
Deliverability Optimization Tip
Always ensure your DKIM record is aligned with your Return-Path and From domain headers. For maximum mailbox provider reputation (Gmail, Yahoo, Microsoft), use 2048-bit RSA keys and maintain a strict DMARC quarantine or reject policy.
Coverage Note: While our scanner tests against extensive worldwide provider selectors and common conventions, DKIM selectors are fundamentally arbitrary strings that can be custom-defined by any domain administrator. If your provider assigned a custom key prefix not detected automatically, enter it directly in the Selector input above.
Selector Namespaces
Selectors allow domains to support multiple sending platforms (e.g. Google, SendGrid, Amazon SES) simultaneously under distinct selector._domainkey records.
DMARC Alignment
When DKIM passes and the signing domain matches the From address, your emails achieve DMARC alignment, stopping spoofing and lifting delivery straight to the primary inbox.
Worldwide Supported Providers & Selector Patterns
Intelligent detection across 40+ major enterprise, marketing, and hosting mail systems
Our scanner performs prioritized infrastructure analysis (MX and SPF records) followed by worldwide provider checks and pattern sweeps (selector1-100, dkim1-100, s1-100, k1-100, m1-100, mail1-100, email1-100, smtp1-100, em1-100, mg1-100, send1-100, and date rotations).
Enterprise & Workspaces
- Google Workspace / Gmail:
google,20230601,20210112,20220608,20240101 - Microsoft 365 / Exchange:
selector1,selector2,s1,s2 - Apple / iCloud Mail:
sig1,sig2,apple,icloud - Yahoo / AOL:
s1024,s2048,s1,s2 - Proton Mail:
protonmail,protonmail2,protonmail3 - Fastmail:
mesmtp,fm1,fm2 - Zoho Mail:
zoho,zmail,zeptomail
Transactional & ESPs
- Amazon SES:
ses,amazonses,ses1,ses2 - Twilio SendGrid:
s1,s2,smtpapi,sendgrid,m1 - Mailgun:
k1,k2,mailgun,mg1,smtp - Postmark:
20200101,pm,postmark,pm1 - Brevo (Sendinblue):
mail,brevo,sendinblue - Mailjet:
mailjet,mj1,mj2 - SparkPost:
scph,scph01..12,sparkpost - Resend:
resend,rs,re - Elastic Email:
api,elasticemail,ee
CRM, Marketing & Hosting
- Klaviyo:
kl,klaviyo,kl1..3 - HubSpot:
hs1,hs2,hubspot - Salesforce / Pardot:
sfdc,salesforce,sf1,pardot - Zendesk:
zendesk1,zendesk2,zd1 - Freshdesk / Freshworks:
freshdesk,fd,fw - ActiveCampaign:
ac,dkim1,dkim2 - ConvertKit / Kit:
convertkit,ck,kit - cPanel / Plesk / DirectAdmin:
default,cpanel,plesk,x - Cloudflare / Security:
cloudflare,mimecast,barracuda,proofpoint
Notice: DKIM selectors are not constrained to any single registry and can be custom-named by domain administrators. If a custom selector was provisioned for your private infrastructure, specify it manually above for real-time verification.