01
What DKIM does
DKIM signatures let receivers verify a signing domain and the integrity of signed content. This lookup retrieves a public key, not a signature verdict.
Free security tool · no sign-up
DKIM Record Checker.
Look up the public key used to verify DKIM signatures. Enter your selector and domain, e.g. google.example.com.
Free for AwareX client employees and anyone who needs a quick check. No sign-up required.
How to check, verify, and actTry an example:
DNS queried via Cloudflare. We don’t store your input.
Your workplace verification guide
Check it. Verify it. Know what to do next.
Look up an email-signing public key for a known selector. This is a public-record check, not a test of an individual message's signature.
Prepare your input
Find your selector in your email provider settings, then enter selector.domain, for example google.example.com.
Run the check
Select Check records. The tool requests the public DNS records through Cloudflare.
Review the result
Review the DKIM entries with your DNS or email administrator before making changes.
How to verify independently
Ask IT for the signing domain and selector, or find d= and s= in an approved message's DKIM-Signature header.
Enter selector.domain, not the full _domainkey hostname, because this tool adds that part.
Ask IT to confirm the returned key before you act on it.
Your next workplace action
Share the selector, domain, and returned record with IT. Never upload a private signing key or change keys yourself.
What the result means
- Public key returned
- A matching record was found for this selector. Its presence does not prove messages are signed correctly.
- No key returned
- The selector may be wrong, retired, or managed through a CNAME. This tool cannot discover every selector.
- Verify a message
- Ask IT to review Authentication-Results for dkim=pass and the signing domain on a real message.
This checker looks up one selector at a time; it cannot discover every selector. A missing TXT result may also require checking a provider-managed CNAME.
Why it matters
Review the key. Understand the signature.
This lookup shows the public key at one DKIM selector. It does not verify a message signature, confirm sender identity, or prove that outgoing mail is being signed.
02
Find your selector
Your email provider names the selector. Common ones are google, selector1, or default. Check a sent message’s headers.
03
Rotate keys
Rotate DKIM keys periodically and remove old selectors to keep your signing posture strong.
DNS standards · sourced facts
Small record.
Important details.
These published DKIM requirements explain what to review with your email administrator. They are standards-based facts, not adoption statistics or findings from your lookup.
2048
Recommended RSA key size
RFC 8301 recommends RSA signing keys of at least 2048 bits. Confirm your provider's supported configuration before changing keys.
IETF · RFC 8301, section 3.21024
Minimum RSA key size
RSA signing keys must be at least 1024 bits. Verifiers must not treat signatures made with smaller RSA keys as valid.
IETF · RFC 8301, section 3.21
Key record per selector
DKIM key records must be unique for a selector name. Different selectors let a domain publish separate signing keys.
IETF · RFC 6376, section 3.6.2.2After the check
Records protect the domain.
People protect the inbox.
DKIM supports email authentication. Even a valid signature cannot tell an employee whether a request is safe. AwareX is a separate human-risk training platform, not a DKIM validation service.
- Your domain
A public key for signed email
Review the selector and key with your provider. Finding the record does not verify a signature or authenticate the person making a request.
- The attacker
A request still needs scrutiny
Lookalike addresses, compromised accounts, SMS, calls, and deepfakes can reach employees regardless of the records returned by this check.
- AwareX
Your people get practice
Separately, AwareX provides contextual simulations and learning that help teams pause, verify, and report. This lookup does not run or validate those activities.
AwareX is AI-powered human risk testing: it learns your business, runs realistic simulations across email, SMS, voice, QR codes, and deepfakes, and adapts learning to how your people respond.
See AwareX in Action - Book a demoTHE PLATFORM BEHIND THE CHECKFive AI agents. One New Age
Five AI agents. One New Age
Human Risk Management platform.
This free tool shows one signal. AwareX is a New Age Human Risk Management platform: five AI agents work together to test your people the way attackers would, and to turn every response into learning.
Context engine
Learns your business from public context: departments, products, and tone, so every test is grounded in how your organization actually works.
Scenario engine
Drafts and scores attack scenarios against your scope, the way a real attacker would plan them.
Lure composer
Writes on-brand emails, messages, and calls with realistic signatures and sender identities, ready for your review.
Risk calibration
Compares predicted risk with how people actually respond, so the picture gets sharper after every wave.
Targeting and routing
Decides who needs practice next and routes learning to the people and teams that need it most.
Beyond the free check
See AwareX
in action.
A DKIM Record Checker result is one piece of the picture. Explore how AwareX connects realistic simulations, learning, and reporting for your organization.
- Explore scenarios tailored to your business.
- See campaign activity and learning progress together.
- Discuss setup, training, and ongoing support.
What this free tool checks
Look up the public key used to verify DKIM signatures. Enter your selector and domain, e.g. google.example.com. This tool queries public DNS through Cloudflare and displays the DKIM records returned for your domain. Use the results to review your configuration; finding a record does not by itself confirm that your domain is secure.
Where we test
- ContextualAn AI agent scans the web
- EmailSpoofed senders and fake invoices
- SMSDelivery alerts and code traps
- VoiceUrgent calls from trusted numbers
- QR CodeCodes on posters and payment slips
- DeepfakeCloned faces and voices on calls
AIDrafted by AI, approved by you
THE IMPROVE FRAMEWORKIMPROVE.
IMPROVE.
One continuous loop.
Identify, Measure, Prioritize, Reduce, Optimize, Validate, and Evaluate. AI connects business context, employee responses, and targeted learning to inform each next test.
WHY TEAMS PARTNER WITH AWAREX
The benefits of partnering with AwareX
A free check tells you where you stand today. A partnership with AwareX turns that snapshot into a continuous, AI-powered program.
Contextual by default
Simulations are written from your sector, your roles, and current events, so every test feels real to the person receiving it.
Learning in the moment
Every response informs the next test and the lesson that follows it, so training adapts as your risk changes.
Evidence you can present
Dashboards, records, and compliance alignment give leadership and auditors a clear picture of progress.
Support at every step
Setup, campaign planning, and ongoing optimization from a team that runs these programs every day.
Frequently asked questions
Good questions.
Straight answers.
Free access, safe follow-up, and answers specific to this checker.
Yes. Every AwareX free tool is free to use, and you can run as many checks as you need.
No. There is no account, no sign-up, and nothing to install. Open the page, run the check, and read the result.
Share the result with your DNS or email administrator, close any gaps they identify against your provider’s recommended setup, and re-run the check to confirm the change.
Enter selector.domain, such as 20230601.gmail.com. The checker adds _domainkey after the selector to look up the public DKIM key.
Check your email provider’s domain settings or the DKIM-Signature header of a message sent from your domain. The s= value is the selector and d= is the signing domain.
The selector may be incorrect, the record may not be published yet, or the provider may use another selector. A missing result for one selector does not prove the whole domain lacks DKIM.
No. This lookup shows a published public key. Verifying a signature requires the complete signed email and the receiver’s authentication results.
THE NEXT ATTACK IS ALREADY BEING WRITTEN, BY AI